diff --git a/core/identity-hub-core/build.gradle.kts b/core/identity-hub-core/build.gradle.kts
index 8aee47e05..e1aeee50f 100644
--- a/core/identity-hub-core/build.gradle.kts
+++ b/core/identity-hub-core/build.gradle.kts
@@ -4,10 +4,12 @@ plugins {
 
 dependencies {
     api(project(":spi:identity-hub-spi"))
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:verifiable-credential-spi"))
+    api(project(":spi:keypair-spi"))
+    api(project(":spi:participant-context-spi"))
+    api(project(":spi:did-spi"))
     implementation(project(":core:lib:verifiable-presentation-lib"))
     implementation(project(":core:lib:accesstoken-lib"))
-    implementation(project(":core:lib:credential-query-lib"))
     implementation(libs.edc.spi.dcp) //SignatureSuiteRegistry
     implementation(libs.edc.spi.jwt.signer)
     implementation(libs.edc.core.connector) // for the CriterionToPredicateConverterImpl
@@ -29,6 +31,9 @@ dependencies {
 
     testImplementation(libs.edc.junit)
     testImplementation(libs.edc.jsonld)
-    testImplementation(testFixtures(project(":spi:identity-hub-store-spi")))
+    testImplementation(testFixtures(project(":spi:keypair-spi")))
+    testImplementation(testFixtures(project(":spi:participant-context-spi")))
+    testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
     testImplementation(testFixtures(libs.edc.vc.jwt)) // JWT generator
+
 }
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/DefaultServicesExtension.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/DefaultServicesExtension.java
index c695c252e..60799969e 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/DefaultServicesExtension.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/DefaultServicesExtension.java
@@ -22,15 +22,15 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.revocation.bitstringstatuslist.BitstringStatusListStatus;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.revocation.statuslist2021.StatusList2021Status;
 import org.eclipse.edc.identityhub.accesstoken.rules.ClaimIsPresentRule;
-import org.eclipse.edc.identityhub.defaults.InMemoryCredentialStore;
-import org.eclipse.edc.identityhub.defaults.InMemoryKeyPairResourceStore;
-import org.eclipse.edc.identityhub.defaults.InMemoryParticipantContextStore;
-import org.eclipse.edc.identityhub.defaults.InMemorySignatureSuiteRegistry;
-import org.eclipse.edc.identityhub.query.EdcScopeToCriterionTransformer;
-import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.defaults.EdcScopeToCriterionTransformer;
+import org.eclipse.edc.identityhub.defaults.store.InMemoryCredentialStore;
+import org.eclipse.edc.identityhub.defaults.store.InMemoryKeyPairResourceStore;
+import org.eclipse.edc.identityhub.defaults.store.InMemoryParticipantContextStore;
+import org.eclipse.edc.identityhub.defaults.store.InMemorySignatureSuiteRegistry;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.transformation.ScopeToCriterionTransformer;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
 import org.eclipse.edc.jwt.validation.jti.JtiValidationStore;
 import org.eclipse.edc.keys.spi.PrivateKeyResolver;
@@ -46,10 +46,10 @@
 import org.eclipse.edc.verifiablecredentials.jwt.rules.JtiValidationRule;
 
 import static org.eclipse.edc.identityhub.DefaultServicesExtension.NAME;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.TOKEN_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.TOKEN_CLAIM;
 
 @Extension(NAME)
 public class DefaultServicesExtension implements ServiceExtension {
@@ -110,7 +110,7 @@ public KeyPairResourceStore createDefaultKeyPairResourceStore() {
     @Provider(isDefault = true)
     public ScopeToCriterionTransformer createScopeTransformer(ServiceExtensionContext context) {
         context.getMonitor().warning("Using the default EdcScopeToCriterionTransformer. This is not intended for production use and should be replaced " +
-                                     "with a specialized implementation for your dataspace");
+                "with a specialized implementation for your dataspace");
         return new EdcScopeToCriterionTransformer();
     }
 
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/CoreServicesExtension.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/CoreServicesExtension.java
index d7176ba02..f200101f9 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/CoreServicesExtension.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/CoreServicesExtension.java
@@ -19,26 +19,26 @@
 import org.eclipse.edc.iam.identitytrust.spi.verification.SignatureSuiteRegistry;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.RevocationServiceRegistry;
-import org.eclipse.edc.identithub.verifiablecredential.CredentialStatusCheckServiceImpl;
-import org.eclipse.edc.identithub.verifiablepresentation.PresentationCreatorRegistryImpl;
-import org.eclipse.edc.identithub.verifiablepresentation.VerifiablePresentationServiceImpl;
-import org.eclipse.edc.identithub.verifiablepresentation.generators.JwtEnvelopedPresentationGenerator;
-import org.eclipse.edc.identithub.verifiablepresentation.generators.JwtPresentationGenerator;
-import org.eclipse.edc.identithub.verifiablepresentation.generators.LdpPresentationGenerator;
-import org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenVerifierImpl;
+import org.eclipse.edc.identityhub.core.services.query.CredentialQueryResolverImpl;
+import org.eclipse.edc.identityhub.core.services.verifiablecredential.CredentialStatusCheckServiceImpl;
+import org.eclipse.edc.identityhub.core.services.verifiablepresentation.PresentationCreatorRegistryImpl;
+import org.eclipse.edc.identityhub.core.services.verifiablepresentation.VerifiablePresentationServiceImpl;
+import org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.JwtEnvelopedPresentationGenerator;
+import org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.JwtPresentationGenerator;
+import org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.LdpPresentationGenerator;
+import org.eclipse.edc.identityhub.core.services.verification.SelfIssuedTokenVerifierImpl;
 import org.eclipse.edc.identityhub.publickey.KeyPairResourcePublicKeyResolver;
-import org.eclipse.edc.identityhub.query.CredentialQueryResolverImpl;
-import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.model.IdentityHubConstants;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.transformation.ScopeToCriterionTransformer;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.CredentialStatusCheckService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.PresentationCreatorRegistry;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.VerifiablePresentationService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.CredentialQueryResolver;
-import org.eclipse.edc.identityhub.spi.verification.AccessTokenVerifier;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
+import org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenVerifier;
 import org.eclipse.edc.jsonld.spi.JsonLd;
 import org.eclipse.edc.jsonld.util.JacksonJsonLd;
 import org.eclipse.edc.jwt.signer.spi.JwsSignerProvider;
@@ -56,6 +56,7 @@
 import org.eclipse.edc.token.JwtGenerationService;
 import org.eclipse.edc.token.spi.TokenValidationRulesRegistry;
 import org.eclipse.edc.token.spi.TokenValidationService;
+import org.eclipse.edc.transaction.spi.TransactionContext;
 import org.eclipse.edc.verifiablecredentials.linkeddata.LdpIssuer;
 
 import java.net.URISyntaxException;
@@ -125,6 +126,8 @@ public class CoreServicesExtension implements ServiceExtension {
     private ParticipantContextService participantContextService;
     @Inject
     private JwsSignerProvider jwsSignerProvider;
+    @Inject
+    private TransactionContext transactionContext;
 
     @Override
     public String name() {
@@ -139,9 +142,9 @@ public void initialize(ServiceExtensionContext context) {
     }
 
     @Provider
-    public AccessTokenVerifier createAccessTokenVerifier(ServiceExtensionContext context) {
+    public SelfIssuedTokenVerifier createAccessTokenVerifier(ServiceExtensionContext context) {
         var keyResolver = new KeyPairResourcePublicKeyResolver(store, keyParserRegistry, context.getMonitor(), fallbackService);
-        return new AccessTokenVerifierImpl(tokenValidationService, keyResolver, tokenValidationRulesRegistry, publicKeyResolver, participantContextService);
+        return new SelfIssuedTokenVerifierImpl(tokenValidationService, keyResolver, tokenValidationRulesRegistry, publicKeyResolver, participantContextService);
     }
 
     @Provider
@@ -152,7 +155,7 @@ public CredentialQueryResolver createCredentialQueryResolver(ServiceExtensionCon
     @Provider
     public PresentationCreatorRegistry presentationCreatorRegistry(ServiceExtensionContext context) {
         if (presentationCreatorRegistry == null) {
-            presentationCreatorRegistry = new PresentationCreatorRegistryImpl(keyPairService, participantContextService);
+            presentationCreatorRegistry = new PresentationCreatorRegistryImpl(keyPairService, participantContextService, transactionContext);
             var jwtGenerationService = new JwtGenerationService(jwsSignerProvider);
             presentationCreatorRegistry.addCreator(new JwtPresentationGenerator(clock, jwtGenerationService), CredentialFormat.VC1_0_JWT);
 
diff --git a/core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImpl.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImpl.java
similarity index 96%
rename from core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImpl.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImpl.java
index 16797c5d5..6a927df6d 100644
--- a/core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImpl.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImpl.java
@@ -12,16 +12,16 @@
  *
  */
 
-package org.eclipse.edc.identityhub.query;
+package org.eclipse.edc.identityhub.core.services.query;
 
 import org.eclipse.edc.iam.identitytrust.spi.model.PresentationQueryMessage;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.RevocationServiceRegistry;
-import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
+import org.eclipse.edc.identityhub.spi.transformation.ScopeToCriterionTransformer;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.CredentialQueryResolver;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.QueryResult;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
@@ -173,7 +173,7 @@ private Result<Collection<VerifiableCredentialResource>> queryCredentials(List<C
     }
 
     private QuerySpec convertToQuerySpec(Criterion criteria, String participantContextId) {
-        var filterByParticipant = new Criterion("participantId", "=", participantContextId);
+        var filterByParticipant = new Criterion("participantContextId", "=", participantContextId);
         var filterNotRevoked = new Criterion("state", "!=", VcStatus.REVOKED.code());
         var filterNotExpired = new Criterion("state", "!=", VcStatus.EXPIRED.code());
         return QuerySpec.Builder.newInstance()
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImpl.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImpl.java
similarity index 98%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImpl.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImpl.java
index 418220d38..37a1b0011 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImpl.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImpl.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablecredential;
+package org.eclipse.edc.identityhub.core.services.verifiablecredential;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.RevocationServiceRegistry;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.CredentialStatusCheckService;
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImpl.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImpl.java
similarity index 59%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImpl.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImpl.java
index eb1fe9eb6..1699e64c8 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImpl.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImpl.java
@@ -13,7 +13,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
@@ -27,23 +27,26 @@
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.PresentationGenerator;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.query.Criterion;
+import org.eclipse.edc.transaction.spi.TransactionContext;
 
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
 import static java.util.Optional.ofNullable;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
 
 public class PresentationCreatorRegistryImpl implements PresentationCreatorRegistry {
 
     private final Map<CredentialFormat, PresentationGenerator<?>> creators = new HashMap<>();
     private final KeyPairService keyPairService;
     private final ParticipantContextService participantContextService;
+    private final TransactionContext transactionContext;
 
-    public PresentationCreatorRegistryImpl(KeyPairService keyPairService, ParticipantContextService participantContextService) {
+    public PresentationCreatorRegistryImpl(KeyPairService keyPairService, ParticipantContextService participantContextService, TransactionContext transactionContext) {
         this.keyPairService = keyPairService;
         this.participantContextService = participantContextService;
+        this.transactionContext = transactionContext;
     }
 
     @Override
@@ -56,28 +59,30 @@ public void addCreator(PresentationGenerator<?> creator, CredentialFormat format
     public <T> T createPresentation(String participantContextId, List<VerifiableCredentialContainer> credentials, CredentialFormat format, Map<String, Object> additionalData) {
         var creator = ofNullable(creators.get(format)).orElseThrow(() -> new EdcException("No %s was found for CredentialFormat %s".formatted(PresentationGenerator.class.getSimpleName(), format)));
 
-        var query = ParticipantResource.queryByParticipantId(participantContextId)
+        var query = ParticipantResource.queryByParticipantContextId(participantContextId)
                 .filter(new Criterion("state", "=", KeyPairState.ACTIVATED.code()))
                 .build();
 
-        var keyPairResult = keyPairService.query(query)
-                .orElseThrow(f -> new EdcException("Error obtaining private key for participant '%s': %s".formatted(participantContextId, f.getFailureDetail())));
+        return transactionContext.execute(() -> {
+            var keyPairResult = keyPairService.query(query)
+                    .orElseThrow(f -> new EdcException("Error obtaining private key for participant '%s': %s".formatted(participantContextId, f.getFailureDetail())));
 
-        // check if there is a default key pair
-        var keyPair = keyPairResult.stream().filter(KeyPairResource::isDefaultPair).findAny()
-                .orElseGet(() -> keyPairResult.stream().findFirst().orElse(null));
+            // check if there is a default key pair
+            var keyPair = keyPairResult.stream().filter(KeyPairResource::isDefaultPair).findAny()
+                    .orElseGet(() -> keyPairResult.stream().findFirst().orElse(null));
 
-        if (keyPair == null) {
-            throw new EdcException("No active key pair found for participant '%s'".formatted(participantContextId));
-        }
+            if (keyPair == null) {
+                throw new EdcException("No active key pair found for participant '%s'".formatted(participantContextId));
+            }
 
-        var did = participantContextService.getParticipantContext(participantContextId)
-                .map(ParticipantContext::getDid)
-                .orElseThrow(f -> new EdcException(f.getFailureDetail()));
+            var did = participantContextService.getParticipantContext(participantContextId)
+                    .map(ParticipantContext::getDid)
+                    .orElseThrow(f -> new EdcException(f.getFailureDetail()));
 
-        var additionalDataWithController = new HashMap<>(additionalData);
-        additionalDataWithController.put(CONTROLLER_ADDITIONAL_DATA, did);
+            var additionalDataWithController = new HashMap<>(additionalData);
+            additionalDataWithController.put(CONTROLLER_ADDITIONAL_DATA, did);
 
-        return (T) creator.generatePresentation(credentials, keyPair.getPrivateKeyAlias(), keyPair.getKeyId(), did, additionalDataWithController);
+            return (T) creator.generatePresentation(credentials, keyPair.getPrivateKeyAlias(), keyPair.getKeyId(), did, additionalDataWithController);
+        });
     }
 }
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImpl.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImpl.java
similarity index 96%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImpl.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImpl.java
index 16e64c1bb..069940ba1 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImpl.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImpl.java
@@ -13,7 +13,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation;
 
 import jakarta.json.JsonObject;
 import org.eclipse.edc.iam.identitytrust.spi.model.PresentationResponseMessage;
@@ -39,7 +39,7 @@
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC1_0_JWT;
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC1_0_LD;
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC2_0_JOSE;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.LdpPresentationGenerator.TYPE_ADDITIONAL_DATA;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.LdpPresentationGenerator.TYPE_ADDITIONAL_DATA;
 
 public class VerifiablePresentationServiceImpl implements VerifiablePresentationService {
     private final PresentationCreatorRegistry registry;
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java
similarity index 96%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java
index 87b514452..2fe8c9429 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGenerator.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
@@ -28,7 +28,7 @@
 import java.util.Map;
 
 import static org.eclipse.edc.iam.verifiablecredentials.spi.VcConstants.VC_PREFIX_V2;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
 
 /**
  * Creates verifiable presentations according to Version 2.0 of the Verifiable Credential Data Model, that are secured
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGenerator.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGenerator.java
similarity index 92%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGenerator.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGenerator.java
index fdadecfc6..6b2d2a338 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGenerator.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGenerator.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import org.eclipse.edc.iam.identitytrust.spi.DcpConstants;
 import org.eclipse.edc.iam.verifiablecredentials.spi.VcConstants;
@@ -33,9 +33,9 @@
 import java.util.Map;
 import java.util.UUID;
 
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.VP_TYPE_PROPERTY;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.VP_TYPE_PROPERTY;
 
 /**
  * JwtPresentationCreator is an implementation of the PresentationCreator interface that generates Verifiable Presentations in JWT format.
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGenerator.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGenerator.java
similarity index 94%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGenerator.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGenerator.java
index c59db4a93..969ecd96d 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGenerator.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGenerator.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import com.apicatalog.vc.suite.SignatureSuite;
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -45,9 +45,9 @@
 import java.util.Map;
 import java.util.UUID;
 
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.VP_TYPE_PROPERTY;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.CONTROLLER_ADDITIONAL_DATA;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.VP_TYPE_PROPERTY;
 
 /**
  * LdpPresentationCreator is a class that implements the PresentationCreator interface to generate Verifiable Presentations based on Verifiable Credential Containers.
diff --git a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorConstants.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorConstants.java
similarity index 89%
rename from core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorConstants.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorConstants.java
index aefee5a13..de0ed125d 100644
--- a/core/lib/verifiable-presentation-lib/src/main/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorConstants.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorConstants.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 /**
  * Contains common constants for {@link LdpPresentationGenerator} and {@link JwtPresentationGenerator}.
diff --git a/core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImpl.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImpl.java
similarity index 79%
rename from core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImpl.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImpl.java
index c20178c4e..2a10098f2 100644
--- a/core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImpl.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImpl.java
@@ -12,11 +12,11 @@
  *
  */
 
-package org.eclipse.edc.identityhub.accesstoken.verification;
+package org.eclipse.edc.identityhub.core.services.verification;
 
 import org.eclipse.edc.identityhub.publickey.KeyPairResourcePublicKeyResolver;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
-import org.eclipse.edc.identityhub.spi.verification.AccessTokenVerifier;
+import org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenVerifier;
 import org.eclipse.edc.jwt.spi.JwtRegisteredClaimNames;
 import org.eclipse.edc.keys.spi.PublicKeyResolver;
 import org.eclipse.edc.spi.result.Result;
@@ -29,16 +29,16 @@
 import java.util.List;
 import java.util.Objects;
 
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.TOKEN_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.TOKEN_CLAIM;
 
 /**
  * Default implementation used to verify Self-Issued tokens. The public key is expected to be found in the
  * issuer's DID
  */
-public class AccessTokenVerifierImpl implements AccessTokenVerifier {
+public class SelfIssuedTokenVerifierImpl implements SelfIssuedTokenVerifier {
 
 
     private static final String SCOPE_SEPARATOR = " ";
@@ -48,8 +48,8 @@ public class AccessTokenVerifierImpl implements AccessTokenVerifier {
     private final PublicKeyResolver publicKeyResolver;
     private final ParticipantContextService participantContextService;
 
-    public AccessTokenVerifierImpl(TokenValidationService tokenValidationService, KeyPairResourcePublicKeyResolver localPublicKeyService, TokenValidationRulesRegistry tokenValidationRulesRegistry,
-                                   PublicKeyResolver publicKeyResolver, ParticipantContextService participantContextService) {
+    public SelfIssuedTokenVerifierImpl(TokenValidationService tokenValidationService, KeyPairResourcePublicKeyResolver localPublicKeyService, TokenValidationRulesRegistry tokenValidationRulesRegistry,
+                                       PublicKeyResolver publicKeyResolver, ParticipantContextService participantContextService) {
         this.tokenValidationService = tokenValidationService;
         this.localPublicKeyService = localPublicKeyService;
         this.tokenValidationRulesRegistry = tokenValidationRulesRegistry;
@@ -58,8 +58,8 @@ public AccessTokenVerifierImpl(TokenValidationService tokenValidationService, Ke
     }
 
     @Override
-    public Result<List<String>> verify(String token, String participantId) {
-        Objects.requireNonNull(participantId, "Participant ID is mandatory.");
+    public Result<List<String>> verify(String token, String participantContextId) {
+        Objects.requireNonNull(participantContextId, "Participant Context ID is mandatory.");
         var res = tokenValidationService.validate(token, publicKeyResolver, tokenValidationRulesRegistry.getRules(DCP_SELF_ISSUED_TOKEN_CONTEXT));
         if (res.failed()) {
             return res.mapFailure();
@@ -74,7 +74,7 @@ public Result<List<String>> verify(String token, String participantId) {
             if (aud == null || aud.isEmpty()) {
                 return Result.failure("Mandatory claim 'aud' on 'token' was null.");
             }
-            var participantDidResult = participantContextService.getParticipantContext(participantId);
+            var participantDidResult = participantContextService.getParticipantContext(participantContextId);
 
             if (participantDidResult.failed()) {
                 return Result.failure(participantDidResult.getFailureDetail());
@@ -99,7 +99,7 @@ public Result<List<String>> verify(String token, String participantId) {
         rules.add(subClaimsMatch);
         rules.add(audMustMatchParticipantIdRule);
         // todo: verify that the resolved public key belongs to the participant ID
-        var result = tokenValidationService.validate(accessTokenString, keyId -> localPublicKeyService.resolveKey(keyId, participantId), rules);
+        var result = tokenValidationService.validate(accessTokenString, keyId -> localPublicKeyService.resolveKey(keyId, participantContextId), rules);
         if (result.failed()) {
             return result.mapFailure();
         }
diff --git a/core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformer.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformer.java
similarity index 95%
rename from core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformer.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformer.java
index 4151ab338..09783c70a 100644
--- a/core/lib/credential-query-lib/src/main/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformer.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformer.java
@@ -12,9 +12,9 @@
  *
  */
 
-package org.eclipse.edc.identityhub.query;
+package org.eclipse.edc.identityhub.defaults;
 
-import org.eclipse.edc.identityhub.spi.ScopeToCriterionTransformer;
+import org.eclipse.edc.identityhub.spi.transformation.ScopeToCriterionTransformer;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.result.Result;
 
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStore.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStore.java
similarity index 86%
rename from core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStore.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStore.java
index ffb58b77c..a943f5ec1 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStore.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStore.java
@@ -12,10 +12,11 @@
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
+import org.eclipse.edc.identityhub.defaults.CredentialResourceLookup;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.query.QueryResolver;
 import org.eclipse.edc.store.ReflectionBasedQueryResolver;
 
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryEntityStore.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryEntityStore.java
similarity index 97%
rename from core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryEntityStore.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryEntityStore.java
index efb9cf9a5..42a80d86b 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryEntityStore.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryEntityStore.java
@@ -8,11 +8,11 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
 import org.eclipse.edc.query.CriterionOperatorRegistryImpl;
 import org.eclipse.edc.spi.query.CriterionOperatorRegistry;
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStore.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStore.java
similarity index 82%
rename from core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStore.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStore.java
index f8d392e7c..b69ba0eef 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStore.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStore.java
@@ -8,14 +8,14 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.spi.query.QueryResolver;
 import org.eclipse.edc.store.ReflectionBasedQueryResolver;
 
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStore.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStore.java
similarity index 79%
rename from core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStore.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStore.java
index 84c0fbf3d..e71958fd7 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStore.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStore.java
@@ -8,14 +8,14 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.spi.query.QueryResolver;
 import org.eclipse.edc.store.ReflectionBasedQueryResolver;
 
@@ -25,7 +25,7 @@
 public class InMemoryParticipantContextStore extends InMemoryEntityStore<ParticipantContext> implements ParticipantContextStore {
     @Override
     protected String getId(ParticipantContext newObject) {
-        return newObject.getParticipantId();
+        return newObject.getParticipantContextId();
     }
 
     @Override
diff --git a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemorySignatureSuiteRegistry.java b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemorySignatureSuiteRegistry.java
similarity index 90%
rename from core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemorySignatureSuiteRegistry.java
rename to core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemorySignatureSuiteRegistry.java
index 859ea5188..b000c62c1 100644
--- a/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/InMemorySignatureSuiteRegistry.java
+++ b/core/identity-hub-core/src/main/java/org/eclipse/edc/identityhub/defaults/store/InMemorySignatureSuiteRegistry.java
@@ -8,11 +8,11 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
 
 import com.apicatalog.vc.suite.SignatureSuite;
diff --git a/core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImplTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImplTest.java
similarity index 97%
rename from core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImplTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImplTest.java
index 56ce2c389..c571f1d47 100644
--- a/core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/CredentialQueryResolverImplTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/query/CredentialQueryResolverImplTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.query;
+package org.eclipse.edc.identityhub.core.services.query;
 
 import org.eclipse.edc.iam.identitytrust.spi.model.PresentationQueryMessage;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
@@ -23,9 +23,10 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.presentationdefinition.PresentationDefinition;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
+import org.eclipse.edc.identityhub.defaults.EdcScopeToCriterionTransformer;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.QueryFailure;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.Result;
@@ -161,7 +162,7 @@ void query_verifyDifferentObjects() {
     void query_whenParticipantIdMismatch_expectEmptyResult() {
         when(storeMock.query(any())).thenAnswer(i -> success(List.of()));
 
-        var res = resolver.query("another_participant_id",
+        var res = resolver.query("another_participant_context_id",
                 createPresentationQuery("org.eclipse.edc.vc.type:TestCredential:read"), List.of("org.eclipse.edc.vc.type:TestCredential:read"));
         assertThat(res.succeeded()).isTrue();
         assertThat(res.getContent()).isEmpty();
@@ -337,10 +338,10 @@ void query_whenRevokedCredential_doesNotInclude() {
 
     private VerifiableCredentialResource.Builder createCredentialResource(VerifiableCredential cred) {
         return VerifiableCredentialResource.Builder.newInstance()
-                .credential(new VerifiableCredentialContainer("foobar", CredentialFormat.JSON_LD, cred))
+                .credential(new VerifiableCredentialContainer("foobar", CredentialFormat.VC1_0_LD, cred))
                 .holderId("test-holder")
                 .issuerId("test-issuer")
-                .participantId(TEST_PARTICIPANT_CONTEXT_ID);
+                .participantContextId(TEST_PARTICIPANT_CONTEXT_ID);
     }
 
     private VerifiableCredential.Builder createCredential(String... type) {
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImplTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImplTest.java
similarity index 98%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImplTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImplTest.java
index c11c01fa4..214651615 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablecredential/CredentialStatusCheckServiceImplTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablecredential/CredentialStatusCheckServiceImplTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablecredential;
+package org.eclipse.edc.identityhub.core.services.verifiablecredential;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialSubject;
@@ -257,7 +257,7 @@ private VerifiableCredentialResource.Builder createCredentialBuilder(VerifiableC
                 .issuerId("test-issuer")
                 .holderId("test-holder")
                 .state(VcStatus.ISSUED)
-                .participantId("participant-id")
+                .participantContextId("participant-id")
                 .credential(new VerifiableCredentialContainer("raw-vc-content", CredentialFormat.JSON_LD, credential))
                 .id(UUID.randomUUID().toString());
     }
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImplTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImplTest.java
similarity index 85%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImplTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImplTest.java
index f2568ef03..21fa4530d 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/PresentationCreatorRegistryImplTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/PresentationCreatorRegistryImplTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
@@ -23,6 +23,7 @@
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.PresentationGenerator;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.result.ServiceResult;
+import org.eclipse.edc.transaction.spi.NoopTransactionContext;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -49,13 +50,13 @@ class PresentationCreatorRegistryImplTest {
     private static final String TEST_PARTICIPANT = "test-participant";
     private final KeyPairService keyPairService = mock();
     private final ParticipantContextService participantContextService = mock();
-    private final PresentationCreatorRegistryImpl registry = new PresentationCreatorRegistryImpl(keyPairService, participantContextService);
+    private final PresentationCreatorRegistryImpl registry = new PresentationCreatorRegistryImpl(keyPairService, participantContextService, new NoopTransactionContext());
 
     @BeforeEach
     void setup() {
         when(participantContextService.getParticipantContext(anyString()))
                 .thenReturn(ServiceResult.success(ParticipantContext.Builder.newInstance()
-                        .participantId("test-participant")
+                        .participantContextId("test-participant")
                         .apiTokenAlias("test-token")
                         .did(ISSUER_ID).build()));
     }
@@ -66,8 +67,8 @@ void createPresentation_whenSingleKey() {
         when(keyPairService.query(any())).thenReturn(ServiceResult.success(List.of(keyPair)));
 
         var generator = mock(PresentationGenerator.class);
-        registry.addCreator(generator, CredentialFormat.JWT);
-        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.JWT, Map.of()));
+        registry.addCreator(generator, CredentialFormat.VC1_0_JWT);
+        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.VC1_0_JWT, Map.of()));
         verify(generator).generatePresentation(anyList(), eq(keyPair.getPrivateKeyAlias()), eq(keyPair.getKeyId()), eq(ISSUER_ID), argThat(additional -> ISSUER_ID.equals(additional.get("controller"))));
     }
 
@@ -75,9 +76,9 @@ void createPresentation_whenSingleKey() {
     void createPresentation_whenKeyPairServiceReturnsFailure() {
         when(keyPairService.query(any())).thenReturn(ServiceResult.notFound("foobar"));
         var generator = mock(PresentationGenerator.class);
-        registry.addCreator(generator, CredentialFormat.JWT);
+        registry.addCreator(generator, CredentialFormat.VC1_0_JWT);
 
-        assertThatThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.JWT, Map.of()))
+        assertThatThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.VC1_0_JWT, Map.of()))
                 .isInstanceOf(EdcException.class)
                 .hasMessage("Error obtaining private key for participant 'test-participant': foobar");
         verifyNoInteractions(generator);
@@ -90,8 +91,8 @@ void createPresentation_whenNoDefaultKey() {
         when(keyPairService.query(any())).thenReturn(ServiceResult.success(List.of(keyPair1, keyPair2)));
 
         var generator = mock(PresentationGenerator.class);
-        registry.addCreator(generator, CredentialFormat.JWT);
-        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.JWT, Map.of()));
+        registry.addCreator(generator, CredentialFormat.VC1_0_JWT);
+        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.VC1_0_JWT, Map.of()));
         verify(generator).generatePresentation(anyList(),
                 argThat(s -> s.equals(keyPair1.getPrivateKeyAlias()) || s.equals(keyPair2.getPrivateKeyAlias())),
                 argThat(s -> s.equals(keyPair1.getKeyId()) || s.equals(keyPair2.getKeyId())),
@@ -107,8 +108,8 @@ void createPresentation_whenDefaultKey() {
         when(keyPairService.query(any())).thenReturn(ServiceResult.success(List.of(keyPair1, keyPair2, keyPair3)));
 
         var generator = mock(PresentationGenerator.class);
-        registry.addCreator(generator, CredentialFormat.JWT);
-        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.JWT, Map.of()));
+        registry.addCreator(generator, CredentialFormat.VC1_0_JWT);
+        assertThatNoException().isThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.VC1_0_JWT, Map.of()));
         verify(generator).generatePresentation(anyList(), eq(keyPair2.getPrivateKeyAlias()), eq(keyPair2.getKeyId()), eq(ISSUER_ID), argThat(additional -> ISSUER_ID.equals(additional.get("controller"))));
     }
 
@@ -117,19 +118,19 @@ void createPresentation_whenNoActiveKey() {
         when(keyPairService.query(any())).thenReturn(ServiceResult.success(List.of()));
 
         var generator = mock(PresentationGenerator.class);
-        registry.addCreator(generator, CredentialFormat.JWT);
-        assertThatThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.JWT, Map.of()))
+        registry.addCreator(generator, CredentialFormat.VC1_0_JWT);
+        assertThatThrownBy(() -> registry.createPresentation(TEST_PARTICIPANT, List.of(), CredentialFormat.VC1_0_JWT, Map.of()))
                 .isInstanceOf(EdcException.class)
                 .hasMessage("No active key pair found for participant 'test-participant'");
         verifyNoInteractions(generator);
     }
 
-    private KeyPairResource.Builder createKeyPair(String participantId, String keyId) {
+    private KeyPairResource.Builder createKeyPair(String participantContextId, String keyId) {
         return KeyPairResource.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
                 .keyId(keyId)
                 .state(KeyPairState.ACTIVATED)
                 .isDefaultPair(true)
-                .privateKeyAlias("%s-%s-alias".formatted(participantId, keyId));
+                .privateKeyAlias("%s-%s-alias".formatted(participantContextId, keyId));
     }
 }
\ No newline at end of file
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImplTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImplTest.java
similarity index 94%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImplTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImplTest.java
index 011de359f..a3996e640 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/VerifiablePresentationServiceImplTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/VerifiablePresentationServiceImplTest.java
@@ -13,7 +13,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -38,10 +38,10 @@
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC1_0_JWT;
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC1_0_LD;
 import static org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat.VC2_0_JOSE;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.TestData.EMPTY_LDP_VP;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.TestData.JWT_VP;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.TestData.LDP_VP_WITH_PROOF;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.TestData.VCDM20_JWT_VP;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.TestData.EMPTY_LDP_VP;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.TestData.JWT_VP;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.TestData.LDP_VP_WITH_PROOF;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.TestData.VCDM20_JWT_VP;
 import static org.eclipse.edc.junit.assertions.AbstractResultAssert.assertThat;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java
similarity index 97%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java
index e662e79fe..53ec94061 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtEnvelopedPresentationGeneratorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.core.type.TypeReference;
@@ -41,7 +41,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.TestData.ENVELOPED_CREDENTIAL_JSON;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.TestData.ENVELOPED_CREDENTIAL_JSON;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGeneratorTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGeneratorTest.java
similarity index 95%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGeneratorTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGeneratorTest.java
index 702dff811..636c80c23 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/JwtPresentationGeneratorTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/JwtPresentationGeneratorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWSHeader;
@@ -42,8 +42,8 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.JwtPresentationGenerator.VERIFIABLE_PRESENTATION_CLAIM;
-import static org.eclipse.edc.identithub.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.JwtPresentationGenerator.VERIFIABLE_PRESENTATION_CLAIM;
+import static org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators.PresentationGeneratorConstants.VERIFIABLE_CREDENTIAL_PROPERTY;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGeneratorTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGeneratorTest.java
similarity index 98%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGeneratorTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGeneratorTest.java
index c871ca54b..36110aca5 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/LdpPresentationGeneratorTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/LdpPresentationGeneratorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nimbusds.jose.jwk.Curve;
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorTest.java
similarity index 96%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorTest.java
index 6fe30d61d..48e650269 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/PresentationGeneratorTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/PresentationGeneratorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.jwk.Curve;
diff --git a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/TestData.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/TestData.java
similarity index 79%
rename from core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/TestData.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/TestData.java
index 6db00ad30..b8de73c24 100644
--- a/core/lib/verifiable-presentation-lib/src/test/java/org/eclipse/edc/identithub/verifiablepresentation/generators/TestData.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verifiablepresentation/generators/TestData.java
@@ -13,7 +13,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.verifiablepresentation.generators;
+package org.eclipse.edc.identityhub.core.services.verifiablepresentation.generators;
 
 public interface TestData {
     String LDP_VC_WITH_PROOF = """
@@ -45,16 +45,16 @@ public interface TestData {
 
     String JWT_VC =
             "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImRpZDpleGFtcGxlOmFiZmUxM2Y3MTIxMjA0MzFjMjc2ZTEyZWNhYiNrZXlzLTEifQ" +
-            ".eyJzdWIiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEiLCJqdGkiOiJodHRwOi8vZXhhbXBsZS5lZHUvY" +
-            "3JlZGVudGlhbHMvMzczMiIsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS5jb20va2V5cy9mb28uandrIiwibmJmIjoxNTQxNDkzNzI0LCJ" +
-            "pYXQiOjE1NDE0OTM3MjQsImV4cCI6MTU3MzAyOTcyMywibm9uY2UiOiI2NjAhNjM0NUZTZXIiLCJ2YyI6eyJAY29udGV4dCI6WyJod" +
-            "HRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSIsImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL2V" +
-            "4YW1wbGVzL3YxIl0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJVbml2ZXJzaXR5RGVncmVlQ3JlZGVudGlhbCJdLCJjc" +
-            "mVkZW50aWFsU3ViamVjdCI6eyJkZWdyZWUiOnsidHlwZSI6IkJhY2hlbG9yRGVncmVlIiwibmFtZSI6IjxzcGFuIGxhbmc9J2ZyLUNB" +
-            "Jz5CYWNjYWxhdXLDqWF0IGVuIG11c2lxdWVzIG51bcOpcmlxdWVzPC9zcGFuPiJ9fX19.KLJo5GAyBND3LDTn9H7FQokEsUEi8jKwXh" +
-            "GvoN3JtRa51xrNDgXDb0cq1UTYB-rK4Ft9YVmR1NI_ZOF8oGc_7wAp8PHbF2HaWodQIoOBxxT-4WNqAxft7ET6lkH-4S6Ux3rSGAmc" +
-            "zMohEEf8eCeN-jC8WekdPl6zKZQj0YPB1rx6X0-xlFBs7cl6Wt8rfBP_tZ9YgVWrQmUWypSioc0MUyiphmyEbLZagTyPlUyflGlEdqr" +
-            "ZAv6eSe6RtxJy6M1-lD7a5HTzanYTWBPAUHDZGyGKXdJw-W_x0IWChBzI8t3kpG253fg6V3tPgHeKXE94fz_QpYfg--7kLsyBAfQGbg";
+                    ".eyJzdWIiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEiLCJqdGkiOiJodHRwOi8vZXhhbXBsZS5lZHUvY" +
+                    "3JlZGVudGlhbHMvMzczMiIsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS5jb20va2V5cy9mb28uandrIiwibmJmIjoxNTQxNDkzNzI0LCJ" +
+                    "pYXQiOjE1NDE0OTM3MjQsImV4cCI6MTU3MzAyOTcyMywibm9uY2UiOiI2NjAhNjM0NUZTZXIiLCJ2YyI6eyJAY29udGV4dCI6WyJod" +
+                    "HRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSIsImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL2V" +
+                    "4YW1wbGVzL3YxIl0sInR5cGUiOlsiVmVyaWZpYWJsZUNyZWRlbnRpYWwiLCJVbml2ZXJzaXR5RGVncmVlQ3JlZGVudGlhbCJdLCJjc" +
+                    "mVkZW50aWFsU3ViamVjdCI6eyJkZWdyZWUiOnsidHlwZSI6IkJhY2hlbG9yRGVncmVlIiwibmFtZSI6IjxzcGFuIGxhbmc9J2ZyLUNB" +
+                    "Jz5CYWNjYWxhdXLDqWF0IGVuIG11c2lxdWVzIG51bcOpcmlxdWVzPC9zcGFuPiJ9fX19.KLJo5GAyBND3LDTn9H7FQokEsUEi8jKwXh" +
+                    "GvoN3JtRa51xrNDgXDb0cq1UTYB-rK4Ft9YVmR1NI_ZOF8oGc_7wAp8PHbF2HaWodQIoOBxxT-4WNqAxft7ET6lkH-4S6Ux3rSGAmc" +
+                    "zMohEEf8eCeN-jC8WekdPl6zKZQj0YPB1rx6X0-xlFBs7cl6Wt8rfBP_tZ9YgVWrQmUWypSioc0MUyiphmyEbLZagTyPlUyflGlEdqr" +
+                    "ZAv6eSe6RtxJy6M1-lD7a5HTzanYTWBPAUHDZGyGKXdJw-W_x0IWChBzI8t3kpG253fg6V3tPgHeKXE94fz_QpYfg--7kLsyBAfQGbg";
 
     String LDP_VP_WITH_PROOF = """
             {
@@ -97,20 +97,20 @@ public interface TestData {
             """;
     String JWT_VP =
             "eyJhbGciOiJFZERTQSJ9.eyJuYmYiOjE2MDI3NjQ4MDEsImlzcyI6ImRpZDpleGFtcGxlOmViZmViMWY3MTJlYmM2ZjFjMjc2ZTEyZWMyMS" +
-            "IsInZwIjp7IkBjb250ZXh0IjoiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiLCJ0eXBlIjoiVmVyaWZpY" +
-            "WJsZVByZXNlbnRhdGlvbiIsInZlcmlmaWFibGVDcmVkZW50aWFsIjoiZXlKaGJHY2lPaUpGWkVSVFFTSjkuZXlKemRXSWlPaUpr" +
-            "YVdRNlpYaGhiWEJzWlRwbFltWmxZakZtTnpFeVpXSmpObVl4WXpJM05tVXhNbVZqTWpFaUxDSnVZbVlpT2pFMU5qQTNNVEUwTVR" +
-            "rc0ltbHpjeUk2SW1ScFpEcGxlR0Z0Y0d4bE9qYzJaVEV5WldNM01USmxZbU0yWmpGak1qSXhaV0ptWldJeFppSXNJbVY0Y0NJNk" +
-            "1UVTJNRGM1TnpneE9Td2lkbU1pT25zaVFHTnZiblJsZUhRaU9sc2lhSFIwY0hNNkx5OTNkM2N1ZHpNdWIzSm5Mekl3TVRndlkzS" +
-            "mxaR1Z1ZEdsaGJITXZkakVpTENKb2RIUndjem92TDNkM2R5NTNNeTV2Y21jdk1qQXhPQzlqY21Wa1pXNTBhV0ZzY3k5bGVHRnRj" +
-            "R3hsY3k5Mk1TSmRMQ0owZVhCbElqcGJJbFpsY21sbWFXRmliR1ZEY21Wa1pXNTBhV0ZzSWl3aVZXNXBkbVZ5YzJsMGVVUmxaM0p" +
-            "sWlVOeVpXUmxiblJwWVd3aVhTd2lZM0psWkdWdWRHbGhiRk4xWW1wbFkzUWlPbnNpWTI5c2JHVm5aU0k2SWxSbGMzUWdWVzVwZG" +
-            "1WeWMybDBlU0lzSW1SbFozSmxaU0k2ZXlKdVlXMWxJam9pUW1GamFHVnNiM0lnYjJZZ1UyTnBaVzVqWlNCaGJtUWdRWEowY3lJc" +
-            "0luUjVjR1VpT2lKQ1lXTm9aV3h2Y2tSbFozSmxaU0o5Zlgwc0ltcDBhU0k2SW1oMGRIQTZMeTlsZUdGdGNHeGxMbVZrZFM5amNt" +
-            "VmtaVzUwYVdGc2N5OHpOek15SW4wLkdEcENPbHhpWjJpc0JRbjE1MWk1UGoyZS1rVWdrTmdfd3p4Q1BBZnhMeHRkT3o0ZnBEaW1" +
-            "nODFtTnczTHNuTzBHNTZBT1R2RDRTdXpTUXlqMWNQM0JnIn0sImlhdCI6MTYwMjc2NDgwMSwianRpIjoidXJuOnV1aWQ6ZWM3ND" +
-            "E1NTYtM2Y2ZS00ODkxLWJlNTQtNzRjMjNmZDkzNjA1In0.kv4Votk1DpFT4Irr-v85W3lorPo9r2p9qwdDrq4kH_veo7qTKtiNh" +
-            "C7BshUwP7zDN5_gD3GTr68OoNks2LoXDw";
+                    "IsInZwIjp7IkBjb250ZXh0IjoiaHR0cHM6Ly93d3cudzMub3JnLzIwMTgvY3JlZGVudGlhbHMvdjEiLCJ0eXBlIjoiVmVyaWZpY" +
+                    "WJsZVByZXNlbnRhdGlvbiIsInZlcmlmaWFibGVDcmVkZW50aWFsIjoiZXlKaGJHY2lPaUpGWkVSVFFTSjkuZXlKemRXSWlPaUpr" +
+                    "YVdRNlpYaGhiWEJzWlRwbFltWmxZakZtTnpFeVpXSmpObVl4WXpJM05tVXhNbVZqTWpFaUxDSnVZbVlpT2pFMU5qQTNNVEUwTVR" +
+                    "rc0ltbHpjeUk2SW1ScFpEcGxlR0Z0Y0d4bE9qYzJaVEV5WldNM01USmxZbU0yWmpGak1qSXhaV0ptWldJeFppSXNJbVY0Y0NJNk" +
+                    "1UVTJNRGM1TnpneE9Td2lkbU1pT25zaVFHTnZiblJsZUhRaU9sc2lhSFIwY0hNNkx5OTNkM2N1ZHpNdWIzSm5Mekl3TVRndlkzS" +
+                    "mxaR1Z1ZEdsaGJITXZkakVpTENKb2RIUndjem92TDNkM2R5NTNNeTV2Y21jdk1qQXhPQzlqY21Wa1pXNTBhV0ZzY3k5bGVHRnRj" +
+                    "R3hsY3k5Mk1TSmRMQ0owZVhCbElqcGJJbFpsY21sbWFXRmliR1ZEY21Wa1pXNTBhV0ZzSWl3aVZXNXBkbVZ5YzJsMGVVUmxaM0p" +
+                    "sWlVOeVpXUmxiblJwWVd3aVhTd2lZM0psWkdWdWRHbGhiRk4xWW1wbFkzUWlPbnNpWTI5c2JHVm5aU0k2SWxSbGMzUWdWVzVwZG" +
+                    "1WeWMybDBlU0lzSW1SbFozSmxaU0k2ZXlKdVlXMWxJam9pUW1GamFHVnNiM0lnYjJZZ1UyTnBaVzVqWlNCaGJtUWdRWEowY3lJc" +
+                    "0luUjVjR1VpT2lKQ1lXTm9aV3h2Y2tSbFozSmxaU0o5Zlgwc0ltcDBhU0k2SW1oMGRIQTZMeTlsZUdGdGNHeGxMbVZrZFM5amNt" +
+                    "VmtaVzUwYVdGc2N5OHpOek15SW4wLkdEcENPbHhpWjJpc0JRbjE1MWk1UGoyZS1rVWdrTmdfd3p4Q1BBZnhMeHRkT3o0ZnBEaW1" +
+                    "nODFtTnczTHNuTzBHNTZBT1R2RDRTdXpTUXlqMWNQM0JnIn0sImlhdCI6MTYwMjc2NDgwMSwianRpIjoidXJuOnV1aWQ6ZWM3ND" +
+                    "E1NTYtM2Y2ZS00ODkxLWJlNTQtNzRjMjNmZDkzNjA1In0.kv4Votk1DpFT4Irr-v85W3lorPo9r2p9qwdDrq4kH_veo7qTKtiNh" +
+                    "C7BshUwP7zDN5_gD3GTr68OoNks2LoXDw";
 
     String VCDM20_JWT_VP = """
             eyJraWQiOiJ2cC1zaWduIiwiYWxnIjoiRVMyNTYifQ.eyJpZCI6ImRhdGE6YXBwbGljYXRpb24vdn
diff --git a/core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplComponentTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplComponentTest.java
similarity index 92%
rename from core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplComponentTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplComponentTest.java
index 407231a03..f9fb4cc5e 100644
--- a/core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplComponentTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplComponentTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.accesstoken.verification;
+package org.eclipse.edc.identityhub.core.services.verification;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWSAlgorithm;
@@ -44,10 +44,10 @@
 import java.security.spec.ECGenParameterSpec;
 import java.util.UUID;
 
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
-import static org.eclipse.edc.identityhub.accesstoken.verification.AccessTokenConstants.TOKEN_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.ACCESS_TOKEN_SCOPE_CLAIM;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_ACCESS_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.DCP_SELF_ISSUED_TOKEN_CONTEXT;
+import static org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenConstants.TOKEN_CLAIM;
 import static org.eclipse.edc.junit.assertions.AbstractResultAssert.assertThat;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -55,13 +55,13 @@
 import static org.mockito.Mockito.when;
 
 @ComponentTest
-class AccessTokenVerifierImplComponentTest {
+class SelfIssuedTokenVerifierImplComponentTest {
 
     public static final String STS_PUBLIC_KEY_ID = "sts-key-123";
     public static final String PARTICIPANT_CONTEXT_ID = "test_participant";
     public static final String PARTICIPANT_DID = "did:web:test_participant";
     private final ParticipantContextService participantContextService = mock();
-    private AccessTokenVerifierImpl verifier;
+    private SelfIssuedTokenVerifierImpl verifier;
     private KeyPair stsKeyPair; // this is used to sign the acces token
     private KeyPair providerKeyPair; // this is used to sign the incoming SI token
     private KeyPairGenerator generator;
@@ -91,8 +91,8 @@ void setUp() throws NoSuchAlgorithmException, InvalidAlgorithmParameterException
         var resolverMock = mock(KeyPairResourcePublicKeyResolver.class);
         when(resolverMock.resolveKey(anyString(), anyString())).thenReturn(Result.success(stsKeyPair.getPublic()));
 
-        when(participantContextService.getParticipantContext(anyString())).thenReturn(ServiceResult.success(ParticipantContext.Builder.newInstance().did(PARTICIPANT_DID).participantId(PARTICIPANT_CONTEXT_ID).apiTokenAlias("foobar").build()));
-        verifier = new AccessTokenVerifierImpl(tokenValidationService, resolverMock, ruleRegistry, (id) -> Result.success(providerKeyPair.getPublic()), participantContextService);
+        when(participantContextService.getParticipantContext(anyString())).thenReturn(ServiceResult.success(ParticipantContext.Builder.newInstance().did(PARTICIPANT_DID).participantContextId(PARTICIPANT_CONTEXT_ID).apiTokenAlias("foobar").build()));
+        verifier = new SelfIssuedTokenVerifierImpl(tokenValidationService, resolverMock, ruleRegistry, (id) -> Result.success(providerKeyPair.getPublic()), participantContextService);
     }
 
 
@@ -147,7 +147,7 @@ void accessToken_audClaimDoesNotBelongToParticipant() {
                 .build());
         when(participantContextService.getParticipantContext(eq(PARTICIPANT_CONTEXT_ID))).thenReturn(ServiceResult.success(ParticipantContext.Builder.newInstance()
                 .did("did:web:someone_else")
-                .participantId(PARTICIPANT_CONTEXT_ID)
+                .participantContextId(PARTICIPANT_CONTEXT_ID)
                 .apiTokenAlias("foobar")
                 .build()));
 
diff --git a/core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplTest.java
similarity index 94%
rename from core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplTest.java
index 9d885bedf..a96b9cb64 100644
--- a/core/lib/accesstoken-lib/src/test/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenVerifierImplTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/core/services/verification/SelfIssuedTokenVerifierImplTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.accesstoken.verification;
+package org.eclipse.edc.identityhub.core.services.verification;
 
 import org.assertj.core.api.Assertions;
 import org.eclipse.edc.identityhub.publickey.KeyPairResourcePublicKeyResolver;
@@ -37,7 +37,7 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-class AccessTokenVerifierImplTest {
+class SelfIssuedTokenVerifierImplTest {
     public static final String OWN_DID = "did:web:consumer";
     public static final String PARTICIPANT_CONTEXT_ID = "did:web:test_participant";
     private static final String OTHER_PARTICIPANT_DID = "did:web:provider";
@@ -50,7 +50,7 @@ class AccessTokenVerifierImplTest {
             .build();
     private final KeyPairResourcePublicKeyResolver localPublicKeyResolver = mock();
     private final ParticipantContextService participantContextService = mock();
-    private final AccessTokenVerifierImpl verifier = new AccessTokenVerifierImpl(tokenValidationSerivce, localPublicKeyResolver, tokenValidationRulesRegistry, pkResolver, participantContextService);
+    private final SelfIssuedTokenVerifierImpl verifier = new SelfIssuedTokenVerifierImpl(tokenValidationSerivce, localPublicKeyResolver, tokenValidationRulesRegistry, pkResolver, participantContextService);
 
     @Test
     void verify_validSiToken_validAccessToken() {
diff --git a/core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformerTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformerTest.java
similarity index 97%
rename from core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformerTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformerTest.java
index ff2a36d0e..2600d3830 100644
--- a/core/lib/credential-query-lib/src/test/java/org/eclipse/edc/identityhub/query/EdcScopeToCriterionTransformerTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/EdcScopeToCriterionTransformerTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.query;
+package org.eclipse.edc.identityhub.defaults;
 
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
diff --git a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStoreTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStoreTest.java
similarity index 75%
rename from core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStoreTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStoreTest.java
index 9406ce17c..beb1319b8 100644
--- a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryCredentialStoreTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryCredentialStoreTest.java
@@ -12,10 +12,10 @@
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
-import org.eclipse.edc.identityhub.store.test.CredentialStoreTestBase;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
+import org.eclipse.edc.identityhub.verifiablecredentials.store.CredentialStoreTestBase;
 
 class InMemoryCredentialStoreTest extends CredentialStoreTestBase {
 
diff --git a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStoreTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStoreTest.java
similarity index 68%
rename from core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStoreTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStoreTest.java
index ec15d0dc4..d961a9471 100644
--- a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryKeyPairResourceStoreTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryKeyPairResourceStoreTest.java
@@ -8,14 +8,14 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.store.test.KeyPairResourceStoreTestBase;
+import org.eclipse.edc.identityhub.keypair.store.KeyPairResourceStoreTestBase;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 
 class InMemoryKeyPairResourceStoreTest extends KeyPairResourceStoreTestBase {
 
diff --git a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStoreTest.java b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStoreTest.java
similarity index 66%
rename from core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStoreTest.java
rename to core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStoreTest.java
index 2c5998e75..761ed52b8 100644
--- a/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/InMemoryParticipantContextStoreTest.java
+++ b/core/identity-hub-core/src/test/java/org/eclipse/edc/identityhub/defaults/store/InMemoryParticipantContextStoreTest.java
@@ -8,14 +8,14 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Metaform Systems Inc. - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.defaults;
+package org.eclipse.edc.identityhub.defaults.store;
 
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
-import org.eclipse.edc.identityhub.store.test.ParticipantContextStoreTestBase;
+import org.eclipse.edc.identityhub.participantcontext.store.ParticipantContextStoreTestBase;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 
 class InMemoryParticipantContextStoreTest extends ParticipantContextStoreTestBase {
 
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/credentials.v1.json b/core/identity-hub-core/src/test/resources/credentials.v1.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/credentials.v1.json
rename to core/identity-hub-core/src/test/resources/credentials.v1.json
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/dcp.v08.json b/core/identity-hub-core/src/test/resources/dcp.v08.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/dcp.v08.json
rename to core/identity-hub-core/src/test/resources/dcp.v08.json
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/did.json b/core/identity-hub-core/src/test/resources/did.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/did.json
rename to core/identity-hub-core/src/test/resources/did.json
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/examples.v1.json b/core/identity-hub-core/src/test/resources/examples.v1.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/examples.v1.json
rename to core/identity-hub-core/src/test/resources/examples.v1.json
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/jws2020.json b/core/identity-hub-core/src/test/resources/jws2020.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/jws2020.json
rename to core/identity-hub-core/src/test/resources/jws2020.json
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/odrl.jsonld b/core/identity-hub-core/src/test/resources/odrl.jsonld
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/odrl.jsonld
rename to core/identity-hub-core/src/test/resources/odrl.jsonld
diff --git a/core/lib/verifiable-presentation-lib/src/test/resources/presentation-exchange.v1.json b/core/identity-hub-core/src/test/resources/presentation-exchange.v1.json
similarity index 100%
rename from core/lib/verifiable-presentation-lib/src/test/resources/presentation-exchange.v1.json
rename to core/identity-hub-core/src/test/resources/presentation-exchange.v1.json
diff --git a/core/identity-hub-did/build.gradle.kts b/core/identity-hub-did/build.gradle.kts
index dbb0cda0c..97b9a9b84 100644
--- a/core/identity-hub-did/build.gradle.kts
+++ b/core/identity-hub-did/build.gradle.kts
@@ -7,7 +7,6 @@ dependencies {
     api(project(":spi:did-spi"))
 
     implementation(project(":spi:keypair-spi"))
-    implementation(project(":spi:identity-hub-store-spi"))
     implementation(project(":spi:participant-context-spi"))
     implementation(libs.edc.core.connector) // for the reflection-based query resolver
     implementation(libs.edc.lib.common.crypto)
diff --git a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImpl.java b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImpl.java
index 9750bcf2e..a2b50fcf8 100644
--- a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImpl.java
+++ b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImpl.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.did;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisher;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisher;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
 
 import java.util.HashMap;
 import java.util.Map;
diff --git a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImpl.java b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImpl.java
index 2b1a2ceb9..05208c3d2 100644
--- a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImpl.java
+++ b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImpl.java
@@ -17,18 +17,18 @@
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
 import org.eclipse.edc.iam.did.spi.document.VerificationMethod;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairActivated;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRevoked;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextUpdated;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.keys.spi.KeyParserRegistry;
 import org.eclipse.edc.security.token.jwt.CryptoConverter;
 import org.eclipse.edc.spi.event.Event;
@@ -72,12 +72,12 @@ public DidDocumentServiceImpl(TransactionContext transactionContext, DidResource
     }
 
     @Override
-    public ServiceResult<Void> store(DidDocument document, String participantId) {
+    public ServiceResult<Void> store(DidDocument document, String participantContextId) {
         return transactionContext.execute(() -> {
             var res = DidResource.Builder.newInstance()
                     .document(document)
                     .did(document.getId())
-                    .participantId(participantId)
+                    .participantContextId(participantContextId)
                     .state(DidState.GENERATED.code())
                     .build();
             var result = didResourceStore.save(res);
@@ -111,8 +111,8 @@ public ServiceResult<Void> publish(String did) {
             if (existingResource == null) {
                 return ServiceResult.notFound(notFoundMessage(did));
             }
-            var participantId = existingResource.getParticipantId();
-            return ServiceResult.from(participantContextStore.findById(participantId))
+            var participantContextId = existingResource.getParticipantContextId();
+            return ServiceResult.from(participantContextStore.findById(participantContextId))
                     .map(ParticipantContext::getStateAsEnum)
                     .compose(state -> {
                         var canPublish = state.equals(ParticipantContextState.ACTIVATED);
@@ -128,7 +128,7 @@ public ServiceResult<Void> publish(String did) {
                         }
                         return ServiceResult.badRequest(("Cannot publish DID '%s' for participant '%s' because the ParticipantContext state is not '%s', " +
                                 "but '%s'.")
-                                .formatted(did, participantId, ParticipantContextState.ACTIVATED, state));
+                                .formatted(did, participantContextId, ParticipantContextState.ACTIVATED, state));
                     });
         });
     }
@@ -141,8 +141,8 @@ public ServiceResult<Void> unpublish(String did) {
                 return ServiceResult.notFound(notFoundMessage(did));
             }
 
-            var participantId = existingResource.getParticipantId();
-            return ServiceResult.from(participantContextStore.findById(participantId))
+            var participantContextId = existingResource.getParticipantContextId();
+            return ServiceResult.from(participantContextStore.findById(participantContextId))
                     .map(ParticipantContext::getStateAsEnum)
                     .compose(state -> {
                         var canUnpublish = state.equals(ParticipantContextState.DEACTIVATED);
@@ -163,7 +163,7 @@ public ServiceResult<Void> unpublish(String did) {
                         }
                         return ServiceResult.badRequest(("Cannot un-publish DID '%s' for participant '%s' because the ParticipantContext is not '%s' state, " +
                                 "but was '%s'.")
-                                .formatted(did, participantId, ParticipantContextState.DEACTIVATED, state));
+                                .formatted(did, participantContextId, ParticipantContextState.DEACTIVATED, state));
                     });
         });
     }
@@ -257,9 +257,9 @@ public <E extends Event> void on(EventEnvelope<E> eventEnvelope) {
 
     private void keyPairActivated(KeyPairActivated event) {
         transactionContext.execute(() -> {
-            var didResources = findByParticipantId(event.getParticipantId());
+            var didResources = findByParticipantContextId(event.getParticipantContextId());
             if (didResources.isEmpty()) {
-                monitor.warning("No DidResources were found for participant '%s'. No updated will be performed.".formatted(event.getParticipantId()));
+                monitor.warning("No DidResources were found for participant '%s'. No updated will be performed.".formatted(event.getParticipantContextId()));
             }
 
             // add the public key as verification method to all did resources
@@ -267,7 +267,7 @@ private void keyPairActivated(KeyPairActivated event) {
             var publicKey = keyParserRegistry.parse(serialized);
 
             if (publicKey.failed()) {
-                monitor.warning("Error adding KeyPair '%s' to DID Document of participant '%s': %s".formatted(event.getKeyPairResource().getId(), event.getParticipantId(), publicKey.getFailureDetail()));
+                monitor.warning("Error adding KeyPair '%s' to DID Document of participant '%s': %s".formatted(event.getKeyPairResource().getId(), event.getParticipantContextId(), publicKey.getFailureDetail()));
                 return;
             }
 
@@ -295,7 +295,7 @@ private void keyPairActivated(KeyPairActivated event) {
     }
 
     private void keypairRevoked(KeyPairRevoked event) {
-        var didResources = findByParticipantId(event.getParticipantId());
+        var didResources = findByParticipantContextId(event.getParticipantContextId());
         var keyId = event.getKeyId();
 
         var errors = didResources.stream()
@@ -312,7 +312,7 @@ private void keypairRevoked(KeyPairRevoked event) {
 
     private void updated(ParticipantContextUpdated event) {
         var newState = event.getNewState();
-        var forParticipant = findByParticipantId(event.getParticipantId());
+        var forParticipant = findByParticipantContextId(event.getParticipantContextId());
         var errors = forParticipant
                 .stream()
                 .map(resource -> switch (newState) {
@@ -329,8 +329,8 @@ private void updated(ParticipantContextUpdated event) {
         }
     }
 
-    private Collection<DidResource> findByParticipantId(String participantId) {
-        return didResourceStore.query(ParticipantResource.queryByParticipantId(participantId).build());
+    private Collection<DidResource> findByParticipantContextId(String participantContextId) {
+        return didResourceStore.query(ParticipantResource.queryByParticipantContextId(participantContextId).build());
     }
 
 }
diff --git a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidServicesExtension.java b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidServicesExtension.java
index fda3ac63e..37011239b 100644
--- a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidServicesExtension.java
+++ b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/DidServicesExtension.java
@@ -14,13 +14,13 @@
 
 package org.eclipse.edc.identityhub.did;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairActivated;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRevoked;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextUpdated;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.keys.spi.KeyParserRegistry;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
diff --git a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/DidDefaultServicesExtension.java b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/DidDefaultServicesExtension.java
index 262f2bf60..53535c728 100644
--- a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/DidDefaultServicesExtension.java
+++ b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/DidDefaultServicesExtension.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.did.defaults;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
diff --git a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStore.java b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStore.java
index 468202600..54814ba09 100644
--- a/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStore.java
+++ b/core/identity-hub-did/src/main/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStore.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.did.defaults;
 
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.spi.query.CriterionOperatorRegistry;
 import org.eclipse.edc.spi.query.QueryResolver;
 import org.eclipse.edc.spi.query.QuerySpec;
diff --git a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImplTest.java b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImplTest.java
index 1b2ff53a1..da1555ad8 100644
--- a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImplTest.java
+++ b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentPublisherRegistryImplTest.java
@@ -14,12 +14,12 @@
 
 package org.eclipse.edc.identityhub.did;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisher;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisher;
 import org.junit.jupiter.api.Test;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.eclipse.edc.identithub.spi.did.DidConstants.DID_WEB_METHOD;
+import static org.eclipse.edc.identityhub.spi.did.DidConstants.DID_WEB_METHOD;
 import static org.mockito.Mockito.mock;
 
 class DidDocumentPublisherRegistryImplTest {
diff --git a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImplTest.java b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImplTest.java
index faa46bb59..ec260775d 100644
--- a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImplTest.java
+++ b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/DidDocumentServiceImplTest.java
@@ -21,18 +21,18 @@
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
 import org.eclipse.edc.iam.did.spi.document.VerificationMethod;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisher;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisher;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairActivated;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRevoked;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextUpdated;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.keys.KeyParserRegistryImpl;
 import org.eclipse.edc.keys.keyparsers.JwkParser;
 import org.eclipse.edc.keys.keyparsers.PemParser;
@@ -84,7 +84,7 @@ void setUp() {
         service = new DidDocumentServiceImpl(trx, didResourceStoreMock, publisherRegistry, participantContextServiceMock, monitorMock, registry);
 
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.ACTIVATED)
                 .build()));
@@ -213,7 +213,7 @@ void unpublish() {
         when(didResourceStoreMock.findById(eq(did))).thenReturn(DidResource.Builder.newInstance().did(did).state(DidState.PUBLISHED).document(doc).build());
         when(publisherMock.unpublish(did)).thenReturn(Result.success());
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build()));
@@ -244,7 +244,7 @@ void unpublish_noPublisherFound() {
         when(publisherRegistry.getPublisher(any())).thenReturn(null);
         when(didResourceStoreMock.findById(eq(did))).thenReturn(DidResource.Builder.newInstance().did(did).state(DidState.PUBLISHED).document(doc).build());
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build()));
@@ -264,7 +264,7 @@ void unpublish_publisherReportsError() {
         when(didResourceStoreMock.findById(eq(did))).thenReturn(DidResource.Builder.newInstance().did(did).state(DidState.PUBLISHED).document(doc).build());
         when(publisherMock.unpublish(did)).thenReturn(Result.failure("test-failure"));
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build()));
@@ -436,7 +436,7 @@ void onParticipantContextUpdated_whenDeactivates_shouldUnpublish() {
         when(publisherMock.unpublish(anyString())).thenReturn(Result.success());
 
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build()));
@@ -444,7 +444,7 @@ void onParticipantContextUpdated_whenDeactivates_shouldUnpublish() {
         service.on(EventEnvelope.Builder.newInstance()
                 .payload(ParticipantContextUpdated.Builder.newInstance()
                         .newState(ParticipantContextState.DEACTIVATED)
-                        .participantId(participantId)
+                        .participantContextId(participantId)
                         .build())
                 .at(System.currentTimeMillis())
                 .id(UUID.randomUUID().toString())
@@ -467,7 +467,7 @@ void onParticipantContextUpdated_whenDeactivated_notPublished_shouldBeNoop() {
         service.on(EventEnvelope.Builder.newInstance()
                 .payload(ParticipantContextUpdated.Builder.newInstance()
                         .newState(ParticipantContextState.DEACTIVATED)
-                        .participantId(participantId)
+                        .participantContextId(participantId)
                         .build())
                 .at(System.currentTimeMillis())
                 .id(UUID.randomUUID().toString())
@@ -488,7 +488,7 @@ void onParticipantContextUpdated_whenDeactivated_published_shouldBeNoop() {
         when(publisherMock.unpublish(anyString())).thenReturn(Result.success());
 
         when(participantContextServiceMock.findById(any())).thenReturn(StoreResult.success(ParticipantContext.Builder.newInstance()
-                .participantId(TEST_PARTICIPANT_ID)
+                .participantContextId(TEST_PARTICIPANT_ID)
                 .apiTokenAlias("token")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build()));
@@ -496,7 +496,7 @@ void onParticipantContextUpdated_whenDeactivated_published_shouldBeNoop() {
         service.on(EventEnvelope.Builder.newInstance()
                 .payload(ParticipantContextUpdated.Builder.newInstance()
                         .newState(ParticipantContextState.DEACTIVATED)
-                        .participantId(participantId)
+                        .participantContextId(participantId)
                         .build())
                 .at(System.currentTimeMillis())
                 .id(UUID.randomUUID().toString())
@@ -519,7 +519,7 @@ void onParticipantContextUpdated_whenActivated_shouldPublish() {
         service.on(EventEnvelope.Builder.newInstance()
                 .payload(ParticipantContextUpdated.Builder.newInstance()
                         .newState(ParticipantContextState.ACTIVATED)
-                        .participantId(participantId)
+                        .participantContextId(participantId)
                         .build())
                 .at(System.currentTimeMillis())
                 .id(UUID.randomUUID().toString())
@@ -548,7 +548,7 @@ void onKeyPairActivated() throws JOSEException {
                 .payload(KeyPairActivated.Builder.newInstance()
                         .keyId(keyId)
                         .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
-                        .participantId("test-participant")
+                        .participantContextId("test-participant")
                         .publicKey(key.toPublicJWK().toJSONString(), JSON_WEB_KEY_2020)
                         .build())
                 .build();
@@ -583,7 +583,7 @@ void onKeyPairRevoked() throws JOSEException {
                 .payload(KeyPairRevoked.Builder.newInstance()
                         .keyId(keyId)
                         .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
-                        .participantId("test-participant")
+                        .participantContextId("test-participant")
                         .build())
                 .build();
 
diff --git a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStoreTest.java b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStoreTest.java
index 24230453f..a157349be 100644
--- a/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStoreTest.java
+++ b/core/identity-hub-did/src/test/java/org/eclipse/edc/identityhub/did/defaults/InMemoryDidResourceStoreTest.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.did.defaults;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.did.store.test.DidResourceStoreTestBase;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.query.CriterionOperatorRegistryImpl;
 
 class InMemoryDidResourceStoreTest extends DidResourceStoreTestBase {
diff --git a/core/identity-hub-keypairs/build.gradle.kts b/core/identity-hub-keypairs/build.gradle.kts
index 5032cc8b0..76e35017e 100644
--- a/core/identity-hub-keypairs/build.gradle.kts
+++ b/core/identity-hub-keypairs/build.gradle.kts
@@ -18,7 +18,7 @@ plugins {
 
 dependencies {
     api(project(":spi:identity-hub-spi"))
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:keypair-spi"))
     api(libs.edc.spi.transaction)
     implementation(project(":core:lib:keypair-lib"))
     implementation(libs.edc.lib.common.crypto)
diff --git a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairEventPublisher.java b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairEventPublisher.java
index 6f15c0e8f..b52115501 100644
--- a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairEventPublisher.java
+++ b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairEventPublisher.java
@@ -40,7 +40,7 @@ public KeyPairEventPublisher(Clock clock, EventRouter eventRouter) {
     @Override
     public void added(KeyPairResource keyPair, String type) {
         var event = KeyPairAdded.Builder.newInstance()
-                .participantId(keyPair.getParticipantId())
+                .participantContextId(keyPair.getParticipantContextId())
                 .keyPairResource(keyPair)
                 .keyId(keyPair.getKeyId())
                 .publicKey(keyPair.getSerializedPublicKey(), type)
@@ -51,7 +51,7 @@ public void added(KeyPairResource keyPair, String type) {
     @Override
     public void rotated(KeyPairResource keyPair, @Nullable KeyDescriptor newKeyDesc) {
         var event = KeyPairRotated.Builder.newInstance()
-                .participantId(keyPair.getParticipantId())
+                .participantContextId(keyPair.getParticipantContextId())
                 .keyPairResource(keyPair)
                 .keyId(keyPair.getKeyId())
                 .newKeyDescriptor(newKeyDesc)
@@ -62,7 +62,7 @@ public void rotated(KeyPairResource keyPair, @Nullable KeyDescriptor newKeyDesc)
     @Override
     public void revoked(KeyPairResource keyPair, @Nullable KeyDescriptor newKeyDesc) {
         var event = KeyPairRevoked.Builder.newInstance()
-                .participantId(keyPair.getParticipantId())
+                .participantContextId(keyPair.getParticipantContextId())
                 .keyPairResource(keyPair)
                 .keyId(keyPair.getKeyId())
                 .newKeyDescriptor(newKeyDesc)
@@ -73,7 +73,7 @@ public void revoked(KeyPairResource keyPair, @Nullable KeyDescriptor newKeyDesc)
     @Override
     public void activated(KeyPairResource activatedKeyPair, String type) {
         var event = KeyPairActivated.Builder.newInstance()
-                .participantId(activatedKeyPair.getParticipantId())
+                .participantContextId(activatedKeyPair.getParticipantContextId())
                 .keyPairResource(activatedKeyPair)
                 .publicKey(activatedKeyPair.getSerializedPublicKey(), type)
                 .keyId(activatedKeyPair.getKeyId())
diff --git a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceExtension.java b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceExtension.java
index 71a964dd9..6b7d9a1cf 100644
--- a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceExtension.java
+++ b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceExtension.java
@@ -16,9 +16,9 @@
 
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairObservable;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextDeleted;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
diff --git a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImpl.java b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImpl.java
index 5a6cd8030..07436e3f6 100644
--- a/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImpl.java
+++ b/core/identity-hub-keypairs/src/main/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImpl.java
@@ -18,14 +18,14 @@
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairObservable;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextCreated;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextDeleted;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.security.token.jwt.CryptoConverter;
 import org.eclipse.edc.spi.event.Event;
 import org.eclipse.edc.spi.event.EventEnvelope;
@@ -71,11 +71,11 @@ public KeyPairServiceImpl(KeyPairResourceStore keyPairResourceStore, Vault vault
     }
 
     @Override
-    public ServiceResult<Void> addKeyPair(String participantId, KeyDescriptor keyDescriptor, boolean makeDefault) {
+    public ServiceResult<Void> addKeyPair(String participantContextId, KeyDescriptor keyDescriptor, boolean makeDefault) {
 
         return transactionContext.execute(() -> {
 
-            var result = checkParticipantState(participantId, ACTIVATED, CREATED);
+            var result = checkParticipantState(participantContextId, ACTIVATED, CREATED);
 
             if (result.failed()) {
                 return result.mapEmpty();
@@ -89,7 +89,7 @@ public ServiceResult<Void> addKeyPair(String participantId, KeyDescriptor keyDes
             // check if the new key is not active, and no other active key exists
             if (!keyDescriptor.isActive()) {
 
-                var hasActiveKeys = keyPairResourceStore.query(ParticipantResource.queryByParticipantId(participantId).build())
+                var hasActiveKeys = keyPairResourceStore.query(ParticipantResource.queryByParticipantContextId(participantContextId).build())
                         .orElse(failure -> Collections.emptySet())
                         .stream().filter(kpr -> kpr.getState() == KeyPairState.ACTIVATED.code())
                         .findAny()
@@ -108,7 +108,7 @@ public ServiceResult<Void> addKeyPair(String participantId, KeyDescriptor keyDes
                     .privateKeyAlias(keyDescriptor.getPrivateKeyAlias())
                     .serializedPublicKey(key.getContent())
                     .timestamp(Instant.now().toEpochMilli())
-                    .participantId(participantId)
+                    .participantContextId(participantContextId)
                     .keyContext(keyDescriptor.getType())
                     .build();
 
@@ -131,7 +131,7 @@ public ServiceResult<Void> rotateKeyPair(String oldId, @Nullable KeyDescriptor n
                 return ServiceResult.notFound("A KeyPairResource with ID '%s' does not exist.".formatted(oldId));
             }
 
-            var participantId = oldKey.getParticipantId();
+            var participantContextId = oldKey.getParticipantContextId();
             boolean wasDefault = oldKey.isDefaultPair();
 
             // deactivate the old key
@@ -142,7 +142,7 @@ public ServiceResult<Void> rotateKeyPair(String oldId, @Nullable KeyDescriptor n
                     .onSuccess(v -> observable.invokeForEach(l -> l.rotated(oldKey, newKeyDesc)));
 
             if (newKeyDesc != null) {
-                return updateResult.compose(v -> addKeyPair(participantId, newKeyDesc, wasDefault));
+                return updateResult.compose(v -> addKeyPair(participantContextId, newKeyDesc, wasDefault));
             }
             monitor.warning("Rotating keys without a successor key may leave the participant without an active keypair.");
             return updateResult;
@@ -157,7 +157,7 @@ public ServiceResult<Void> revokeKey(String id, @Nullable KeyDescriptor newKeyDe
                 return ServiceResult.notFound("A KeyPairResource with ID '%s' does not exist.".formatted(id));
             }
 
-            var participantId = oldKey.getParticipantId();
+            var participantContextId = oldKey.getParticipantContextId();
             boolean wasDefault = oldKey.isDefaultPair();
 
             // deactivate the old key
@@ -168,7 +168,7 @@ public ServiceResult<Void> revokeKey(String id, @Nullable KeyDescriptor newKeyDe
                     .onSuccess(v -> observable.invokeForEach(l -> l.revoked(oldKey, newKeyDesc)));
 
             if (newKeyDesc != null) {
-                return updateResult.compose(v -> addKeyPair(participantId, newKeyDesc, wasDefault));
+                return updateResult.compose(v -> addKeyPair(participantContextId, newKeyDesc, wasDefault));
             }
             monitor.warning("Revoking keys without a successor key may leave the participant without an active keypair.");
             return updateResult;
@@ -203,24 +203,24 @@ public <E extends Event> void on(EventEnvelope<E> eventEnvelope) {
     }
 
     /**
-     * checks if the participant exists, and that its {@link ParticipantContext#state} flag matches either of the given states
+     * checks if the participant exists, and that its {@link ParticipantContext#getState()} flag matches either of the given states
      *
-     * @param participantId the ParticipantContext ID of the participant context
-     * @param allowedStates a (possible empty) list of allowed states a participant may be in for a particular operation.
+     * @param participantContextId the ParticipantContext ID of the participant context
+     * @param allowedStates        a (possible empty) list of allowed states a participant may be in for a particular operation.
      * @return {@link ServiceResult#success()} if the participant context exists, and is in one of the allowed states, a failure otherwise.
      */
-    private ServiceResult<Void> checkParticipantState(String participantId, ParticipantContextState... allowedStates) {
-        var result = ServiceResult.from(participantContextService.query(ParticipantContext.queryByParticipantId(participantId).build()))
+    private ServiceResult<Void> checkParticipantState(String participantContextId, ParticipantContextState... allowedStates) {
+        var result = ServiceResult.from(participantContextService.query(ParticipantContext.queryByParticipantContextId(participantContextId).build()))
                 .compose(list -> list.stream().findFirst()
                         .map(pc -> {
                             var state = pc.getStateAsEnum();
                             if (!Arrays.asList(allowedStates).contains(state)) {
                                 return ServiceResult.badRequest("To add a key pair, the ParticipantContext with ID '%s' must be in state %s or %s but was %s."
-                                        .formatted(participantId, ACTIVATED, CREATED, state));
+                                        .formatted(participantContextId, ACTIVATED, CREATED, state));
                             }
                             return ServiceResult.success();
                         })
-                        .orElse(ServiceResult.notFound("No ParticipantContext with ID '%s' was found.".formatted(participantId))));
+                        .orElse(ServiceResult.notFound("No ParticipantContext with ID '%s' was found.".formatted(participantContextId))));
         return result.mapEmpty();
     }
 
@@ -236,13 +236,13 @@ private ServiceResult<Void> checkParticipantState(String participantId, Particip
     }
 
     private void created(ParticipantContextCreated event) {
-        addKeyPair(event.getParticipantId(), event.getManifest().getKey(), true)
+        addKeyPair(event.getParticipantContextId(), event.getManifest().getKey(), true)
                 .onFailure(f -> monitor.warning("Adding the key pair to a new ParticipantContext failed: %s".formatted(f.getFailureDetail())));
     }
 
     private void deleted(ParticipantContextDeleted event) {
         //hard-delete all keypairs that are associated with the deleted participant
-        var query = ParticipantResource.queryByParticipantId(event.getParticipantId()).build();
+        var query = ParticipantResource.queryByParticipantContextId(event.getParticipantContextId()).build();
         transactionContext.execute(() -> {
             keyPairResourceStore.query(query)
                     .compose(list -> {
diff --git a/core/identity-hub-keypairs/src/test/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImplTest.java b/core/identity-hub-keypairs/src/test/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImplTest.java
index 7f70860ea..34350f940 100644
--- a/core/identity-hub-keypairs/src/test/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImplTest.java
+++ b/core/identity-hub-keypairs/src/test/java/org/eclipse/edc/identityhub/keypairs/KeyPairServiceImplTest.java
@@ -20,11 +20,11 @@
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairObservable;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.StoreResult;
 import org.eclipse.edc.spi.security.Vault;
@@ -67,11 +67,11 @@ class KeyPairServiceImplTest {
     @BeforeEach
     void setup() {
         when(participantContextServiceMock.query(any(QuerySpec.class)))
-                .thenReturn(StoreResult.success(List.of(ParticipantContext.Builder.newInstance().participantId(PARTICIPANT_ID).apiTokenAlias("apitoken-alias").build())));
+                .thenReturn(StoreResult.success(List.of(ParticipantContext.Builder.newInstance().participantContextId(PARTICIPANT_ID).apiTokenAlias("apitoken-alias").build())));
     }
 
     @ParameterizedTest(name = "make default: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void addKeyPair_publicKeyGiven(boolean makeDefault) {
 
         when(keyPairResourceStore.create(any())).thenReturn(success());
@@ -79,7 +79,7 @@ void addKeyPair_publicKeyGiven(boolean makeDefault) {
 
         assertThat(keyPairService.addKeyPair(PARTICIPANT_ID, key, makeDefault)).isSucceeded();
 
-        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() == makeDefault && kpr.getParticipantId().equals(PARTICIPANT_ID)));
+        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() == makeDefault && kpr.getParticipantContextId().equals(PARTICIPANT_ID)));
         // new key is set to active - expect an update in the DB
         verify(keyPairResourceStore).update(argThat(kpr -> !kpr.getId().equals(key.getKeyId()) && kpr.getState() == KeyPairState.ACTIVATED.code()));
         verify(observableMock, times(2)).invokeForEach(any());
@@ -87,7 +87,7 @@ void addKeyPair_publicKeyGiven(boolean makeDefault) {
     }
 
     @ParameterizedTest(name = "make default: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void addKeyPair_shouldGenerate_storesInVault(boolean makeDefault) {
         when(keyPairResourceStore.create(any())).thenReturn(success());
 
@@ -100,7 +100,7 @@ void addKeyPair_shouldGenerate_storesInVault(boolean makeDefault) {
 
         verify(vault).storeSecret(eq(key.getPrivateKeyAlias()), anyString());
         verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() == makeDefault &&
-                kpr.getParticipantId().equals(PARTICIPANT_ID) &&
+                kpr.getParticipantContextId().equals(PARTICIPANT_ID) &&
                 kpr.getState() == KeyPairState.ACTIVATED.code()));
         // new key is set to active - expect an update in the DB
         verify(keyPairResourceStore).update(argThat(kpr -> !kpr.getId().equals(key.getKeyId()) && kpr.getState() == KeyPairState.ACTIVATED.code()));
@@ -126,7 +126,7 @@ void addKeyPair_assertActiveState_whenKeyActive() {
         verify(vault).storeSecret(eq(key.getPrivateKeyAlias()), anyString());
         //expect the query for other active keys at least once, if the new key is inactive
         verify(keyPairResourceStore, never()).query(any());
-        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() && kpr.getParticipantId().equals(PARTICIPANT_ID) && kpr.getState() == KeyPairState.ACTIVATED.code()));
+        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() && kpr.getParticipantContextId().equals(PARTICIPANT_ID) && kpr.getState() == KeyPairState.ACTIVATED.code()));
         // new key is set to active - expect an update in the DB
         verify(keyPairResourceStore).update(argThat(kpr -> !kpr.getId().equals(key.getKeyId()) && kpr.getState() == KeyPairState.ACTIVATED.code()));
         verify(observableMock, times(2)).invokeForEach(any());
@@ -151,7 +151,7 @@ void addKeyPair_assertActiveState_whenKeyNotActive() {
         verify(vault).storeSecret(eq(key.getPrivateKeyAlias()), anyString());
         //expect the query for other active keys at least once, if the new key is inactive
         verify(keyPairResourceStore, times(1)).query(any());
-        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() && kpr.getParticipantId().equals(PARTICIPANT_ID) && kpr.getState() == KeyPairState.CREATED.code()));
+        verify(keyPairResourceStore).create(argThat(kpr -> kpr.isDefaultPair() && kpr.getParticipantContextId().equals(PARTICIPANT_ID) && kpr.getState() == KeyPairState.CREATED.code()));
         verify(observableMock, times(1)).invokeForEach(any());
         verifyNoMoreInteractions(keyPairResourceStore, vault, observableMock);
     }
@@ -168,7 +168,7 @@ void addKeyPair_participantNotFound() {
     @Test
     void addKeyPair_whenParticipantDeactivated_shouldFail() {
         var pc = ParticipantContext.Builder.newInstance()
-                .participantId(PARTICIPANT_ID)
+                .participantContextId(PARTICIPANT_ID)
                 .apiTokenAlias("apitoken-alias")
                 .state(ParticipantContextState.DEACTIVATED)
                 .build();
@@ -391,7 +391,7 @@ void revokeKey_notfound() {
 
     @ParameterizedTest(name = "Valid state = {0}")
     // cannot use enum literals and the .code() method -> needs to be compile constant
-    @ValueSource(ints = { 100, 200 })
+    @ValueSource(ints = {100, 200})
     void activate(int validState) {
         var oldId = "old-id";
         var oldKey = createKeyPairResource().id(oldId).state(validState).build();
@@ -404,7 +404,7 @@ void activate(int validState) {
 
     @ParameterizedTest(name = "Valid state = {0}")
     // cannot use enum literals and the .code() method -> needs to be compile constant
-    @ValueSource(ints = { 0, 30, 400, -10 })
+    @ValueSource(ints = {0, 30, 400, -10})
     void activate_invalidState(int validState) {
         var oldId = "old-id";
         var oldKey = createKeyPairResource().id(oldId).state(validState).build();
@@ -434,7 +434,7 @@ private KeyPairResource.Builder createKeyPairResource() {
                 .id(UUID.randomUUID().toString())
                 .keyId("test-key-1")
                 .privateKeyAlias("private-key-alias")
-                .participantId(PARTICIPANT_ID)
+                .participantContextId(PARTICIPANT_ID)
                 .serializedPublicKey("this-is-a-pem-string")
                 .useDuration(Duration.ofDays(6).toMillis());
     }
diff --git a/core/identity-hub-participants/build.gradle.kts b/core/identity-hub-participants/build.gradle.kts
index e5502ce4d..2694b6b09 100644
--- a/core/identity-hub-participants/build.gradle.kts
+++ b/core/identity-hub-participants/build.gradle.kts
@@ -5,7 +5,8 @@ plugins {
 dependencies {
     api(project(":spi:identity-hub-spi"))
     api(project(":spi:did-spi"))
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:participant-context-spi"))
+    api(project(":spi:keypair-spi"))
     api(libs.edc.spi.transaction)
     implementation(project(":core:lib:keypair-lib"))
     implementation(libs.edc.lib.common.crypto)
diff --git a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextCoordinatorExtension.java b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextCoordinatorExtension.java
index 7de2425da..220059dad 100644
--- a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextCoordinatorExtension.java
+++ b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextCoordinatorExtension.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.participantcontext;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextCreated;
diff --git a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinator.java b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinator.java
index 2827091fa..0184e7a4f 100644
--- a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinator.java
+++ b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinator.java
@@ -15,7 +15,7 @@
 package org.eclipse.edc.identityhub.participantcontext;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
@@ -76,7 +76,7 @@ public <E extends Event> void on(EventEnvelope<E> event) {
 
             didDocumentService.store(doc, manifest.getParticipantId())
                     // adding the keypair event will cause the DidDocumentService to update the DID
-                    .compose(u -> keyPairService.addKeyPair(createdEvent.getParticipantId(), createdEvent.getManifest().getKey(), true))
+                    .compose(u -> keyPairService.addKeyPair(createdEvent.getParticipantContextId(), createdEvent.getManifest().getKey(), true))
                     .compose(u -> manifest.isActive()
                             ? participantContextService.updateParticipant(manifest.getParticipantId(), ParticipantContext::activate) //implicitly publishes the did document
                             : success())
@@ -88,7 +88,7 @@ public <E extends Event> void on(EventEnvelope<E> event) {
             // unpublish and delete did document, remove keypairs
             didDocumentService.unpublish(participantContext.getDid())
                     .compose(u -> didDocumentService.deleteById(participantContext.getDid()))
-                    .compose(u -> keyPairService.query(KeyPairResource.queryByParticipantId(participantContext.getParticipantId()).build()))
+                    .compose(u -> keyPairService.query(KeyPairResource.queryByParticipantContextId(participantContext.getParticipantContextId()).build()))
                     .compose(keyPairs -> keyPairs.stream()
                             .map(r -> keyPairService.revokeKey(r.getId(), null))
                             .reduce(this::merge)
diff --git a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventPublisher.java b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventPublisher.java
index 0b6b1f8f2..413edddfc 100644
--- a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventPublisher.java
+++ b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventPublisher.java
@@ -39,7 +39,7 @@ public ParticipantContextEventPublisher(Clock clock, EventRouter eventRouter) {
     @Override
     public void created(ParticipantContext newContext, ParticipantManifest manifest) {
         var event = ParticipantContextCreated.Builder.newInstance()
-                .participantId(newContext.getParticipantId())
+                .participantContextId(newContext.getParticipantContextId())
                 .manifest(manifest)
                 .build();
         publish(event);
@@ -48,7 +48,7 @@ public void created(ParticipantContext newContext, ParticipantManifest manifest)
     @Override
     public void updated(ParticipantContext updatedContext) {
         var event = ParticipantContextUpdated.Builder.newInstance()
-                .participantId(updatedContext.getParticipantId())
+                .participantContextId(updatedContext.getParticipantContextId())
                 .newState(updatedContext.getStateAsEnum())
                 .build();
         publish(event);
@@ -57,7 +57,7 @@ public void updated(ParticipantContext updatedContext) {
     @Override
     public void deleting(ParticipantContext deletedContext) {
         var event = ParticipantContextDeleting.Builder.newInstance()
-                .participantId(deletedContext.getParticipantId())
+                .participantContextId(deletedContext.getParticipantContextId())
                 .participant(deletedContext)
                 .build();
         publish(event);
@@ -66,7 +66,7 @@ public void deleting(ParticipantContext deletedContext) {
     @Override
     public void deleted(ParticipantContext deletedContext) {
         var event = ParticipantContextDeleted.Builder.newInstance()
-                .participantId(deletedContext.getParticipantId())
+                .participantContextId(deletedContext.getParticipantContextId())
                 .build();
         publish(event);
     }
diff --git a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextExtension.java b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextExtension.java
index 991f9ab6c..e8bb12f05 100644
--- a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextExtension.java
+++ b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextExtension.java
@@ -14,12 +14,12 @@
 
 package org.eclipse.edc.identityhub.participantcontext;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
diff --git a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImpl.java b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImpl.java
index a62a1dc38..cd7c78fda 100644
--- a/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImpl.java
+++ b/core/identity-hub-participants/src/main/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImpl.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.participantcontext;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
@@ -22,7 +22,7 @@
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.ServiceResult;
 import org.eclipse.edc.spi.security.Vault;
@@ -92,23 +92,23 @@ public ServiceResult<CreateParticipantContextResponse> createParticipantContext(
     }
 
     @Override
-    public ServiceResult<ParticipantContext> getParticipantContext(String participantId) {
-        return transactionContext.execute(() -> ServiceResult.from(participantContextStore.findById(participantId)));
+    public ServiceResult<ParticipantContext> getParticipantContext(String participantContextId) {
+        return transactionContext.execute(() -> ServiceResult.from(participantContextStore.findById(participantContextId)));
     }
 
     @Override
-    public ServiceResult<Void> deleteParticipantContext(String participantId) {
+    public ServiceResult<Void> deleteParticipantContext(String participantContextId) {
         return transactionContext.execute(() -> {
-            var participantContext = findByIdInternal(participantId);
+            var participantContext = findByIdInternal(participantContextId);
             if (participantContext == null) {
                 return ServiceResult.notFound("A ParticipantContext with ID '%s' does not exist.");
             }
             // deactivating the PC must be the first step, because unpublishing DIDs requires the PC to be in the DEACTIVATED state.
             // Unpublishing DIDs happens in callback of the "-Deleting" Event
-            return updateParticipant(participantId, ParticipantContext::deactivate)
+            return updateParticipant(participantContextId, ParticipantContext::deactivate)
                     .compose(v -> {
                         observable.invokeForEach(l -> l.deleting(participantContext));
-                        var res = participantContextStore.deleteById(participantId);
+                        var res = participantContextStore.deleteById(participantContextId);
                         vault.deleteSecret(participantContext.getApiTokenAlias());
                         if (res.failed()) {
                             return fromFailure(res);
@@ -121,9 +121,9 @@ public ServiceResult<Void> deleteParticipantContext(String participantId) {
     }
 
     @Override
-    public ServiceResult<String> regenerateApiToken(String participantId) {
+    public ServiceResult<String> regenerateApiToken(String participantContextId) {
         return transactionContext.execute(() -> {
-            var participantContext = getParticipantContext(participantId);
+            var participantContext = getParticipantContext(participantContextId);
             if (participantContext.failed()) {
                 return participantContext.map(pc -> null);
             }
@@ -132,11 +132,11 @@ public ServiceResult<String> regenerateApiToken(String participantId) {
     }
 
     @Override
-    public ServiceResult<Void> updateParticipant(String participantId, Consumer<ParticipantContext> modificationFunction) {
+    public ServiceResult<Void> updateParticipant(String participantContextId, Consumer<ParticipantContext> modificationFunction) {
         return transactionContext.execute(() -> {
-            var participant = findByIdInternal(participantId);
+            var participant = findByIdInternal(participantContextId);
             if (participant == null) {
-                return notFound("ParticipantContext with ID '%s' not found.".formatted(participantId));
+                return notFound("ParticipantContext with ID '%s' not found.".formatted(participantContextId));
             }
             modificationFunction.accept(participant);
             var res = participantContextStore.update(participant)
@@ -153,7 +153,7 @@ public ServiceResult<Collection<ParticipantContext>> query(QuerySpec querySpec)
 
     private ServiceResult<String> createTokenAndStoreInVault(ParticipantContext participantContext) {
         var alias = participantContext.getApiTokenAlias();
-        var newToken = tokenGenerator.generate(participantContext.getParticipantId());
+        var newToken = tokenGenerator.generate(participantContext.getParticipantContextId());
         return vault.storeSecret(alias, newToken)
                 .map(unused -> success(newToken))
                 .orElse(f -> conflict("Could not store new API token: %s.".formatted(f.getFailureDetail())));
@@ -165,15 +165,15 @@ private ServiceResult<ParticipantContext> createParticipantContext(ParticipantCo
         return ServiceResult.from(result).map(it -> context);
     }
 
-    private ParticipantContext findByIdInternal(String participantId) {
-        var resultStream = participantContextStore.findById(participantId);
+    private ParticipantContext findByIdInternal(String participantContextId) {
+        var resultStream = participantContextStore.findById(participantContextId);
         return resultStream.orElse(f -> null);
     }
 
 
     private ParticipantContext convert(ParticipantManifest manifest) {
         return ParticipantContext.Builder.newInstance()
-                .participantId(manifest.getParticipantId())
+                .participantContextId(manifest.getParticipantId())
                 .roles(manifest.getRoles())
                 .did(manifest.getDid())
                 .apiTokenAlias("%s-%s".formatted(manifest.getParticipantId(), API_KEY_ALIAS_SUFFIX))
diff --git a/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinatorTest.java b/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinatorTest.java
index 0936a9465..3750e4cf7 100644
--- a/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinatorTest.java
+++ b/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextEventCoordinatorTest.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.participantcontext;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextCreated;
@@ -63,7 +63,7 @@ void onParticipantCreated() {
         when(keyPairService.addKeyPair(eq(participantId), any(), anyBoolean())).thenReturn(ServiceResult.success());
 
         coordinator.on(envelope(ParticipantContextCreated.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .manifest(createManifest().build())
                 .build()));
 
@@ -78,7 +78,7 @@ void onParticipantCreated_didDocumentServiceStoreFailure() {
         when(didDocumentService.store(any(), eq(participantId))).thenReturn(ServiceResult.badRequest("foobar"));
 
         coordinator.on(envelope(ParticipantContextCreated.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .manifest(createManifest().build())
                 .build()));
 
@@ -94,7 +94,7 @@ void onParticipantCreated_active_didDocumentServicePublishFailure() {
         when(keyPairService.addKeyPair(eq(participantId), any(), anyBoolean())).thenReturn(ServiceResult.success());
 
         coordinator.on(envelope(ParticipantContextCreated.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .manifest(createManifest().active(true).build())
                 .build()));
 
@@ -110,7 +110,7 @@ void onParticipantCreated_notActive_shouldNotPublish() {
         when(keyPairService.addKeyPair(eq(participantId), any(), anyBoolean())).thenReturn(ServiceResult.success());
 
         coordinator.on(envelope(ParticipantContextCreated.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .manifest(createManifest().active(false).build())
                 .build()));
 
@@ -127,7 +127,7 @@ void onParticipantCreated_active_whenKeyPairServiceFailure_shouldNotPublish() {
         when(keyPairService.addKeyPair(eq(participantId), any(KeyDescriptor.class), anyBoolean())).thenReturn(ServiceResult.notFound("foobar"));
 
         coordinator.on(envelope(ParticipantContextCreated.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .manifest(createManifest().active(true).build())
                 .build()));
 
diff --git a/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImplTest.java b/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImplTest.java
index 9cfebeb1d..e85636b35 100644
--- a/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImplTest.java
+++ b/core/identity-hub-participants/src/test/java/org/eclipse/edc/identityhub/participantcontext/ParticipantContextServiceImplTest.java
@@ -17,8 +17,8 @@
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.jwk.Curve;
 import com.nimbusds.jose.jwk.gen.OctetKeyPairGenerator;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.AccountInfo;
 import org.eclipse.edc.identityhub.spi.participantcontext.StsAccountProvisioner;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextObservable;
@@ -26,7 +26,7 @@
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.keys.KeyParserRegistryImpl;
 import org.eclipse.edc.keys.keyparsers.PemParser;
 import org.eclipse.edc.spi.query.QuerySpec;
@@ -75,7 +75,7 @@ void setUp() {
     }
 
     @ParameterizedTest(name = "isActive: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void createParticipantContext_withPublicKeyPem(boolean isActive) {
         when(participantContextStore.create(any())).thenReturn(StoreResult.success());
         when(vault.storeSecret(anyString(), anyString())).thenReturn(Result.success());
@@ -107,7 +107,7 @@ void createParticipantContext_withPublicKeyPem(boolean isActive) {
     }
 
     @ParameterizedTest(name = "isActive: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void shouldCreateParticipantContext_withAccountInfo(boolean isActive) {
         when(participantContextStore.create(any())).thenReturn(StoreResult.success());
         when(vault.storeSecret(anyString(), anyString())).thenReturn(Result.success());
@@ -137,7 +137,7 @@ void shouldCreateParticipantContext_withAccountInfo(boolean isActive) {
     }
 
     @ParameterizedTest(name = "isActive: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void createParticipantContext_withPublicKeyJwk(boolean isActive) {
         when(participantContextStore.create(any())).thenReturn(StoreResult.success());
         when(vault.storeSecret(anyString(), anyString())).thenReturn(Result.success());
@@ -148,14 +148,14 @@ void createParticipantContext_withPublicKeyJwk(boolean isActive) {
                 .isSucceeded();
 
         verify(participantContextStore).create(argThat(pc -> pc.getDid() != null &&
-                pc.getParticipantId().equalsIgnoreCase("test-id")));
+                pc.getParticipantContextId().equalsIgnoreCase("test-id")));
         verify(vault).storeSecret(eq(ctx.getParticipantId() + "-apikey"), anyString());
         verifyNoMoreInteractions(vault, participantContextStore);
         verify(observableMock).invokeForEach(any());
     }
 
     @ParameterizedTest(name = "isActive: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void createParticipantContext_withKeyGenParams(boolean isActive) {
         when(participantContextStore.create(any())).thenReturn(StoreResult.success());
         when(vault.storeSecret(anyString(), anyString())).thenReturn(Result.success());
@@ -325,7 +325,7 @@ void update() {
         var context = createContext();
         when(participantContextStore.findById(anyString())).thenReturn(StoreResult.success(context));
         when(participantContextStore.update(any())).thenReturn(StoreResult.success());
-        assertThat(participantContextService.updateParticipant(context.getParticipantId(), ParticipantContext::deactivate)).isSucceeded();
+        assertThat(participantContextService.updateParticipant(context.getParticipantContextId(), ParticipantContext::deactivate)).isSucceeded();
 
         verify(participantContextStore).findById(anyString());
         verify(participantContextStore).update(any());
@@ -336,7 +336,7 @@ void update() {
     void update_whenNotFound() {
         var context = createContext();
         when(participantContextStore.findById(anyString())).thenReturn(StoreResult.notFound("foobar"));
-        assertThat(participantContextService.updateParticipant(context.getParticipantId(), ParticipantContext::deactivate)).isFailed()
+        assertThat(participantContextService.updateParticipant(context.getParticipantContextId(), ParticipantContext::deactivate)).isFailed()
                 .detail().isEqualTo("ParticipantContext with ID 'test-id' not found.");
 
         verify(participantContextStore).findById(anyString());
@@ -349,7 +349,7 @@ void update_whenStoreUpdateFails() {
         when(participantContextStore.findById(anyString())).thenReturn(StoreResult.success(context));
         when(participantContextStore.update(any())).thenReturn(StoreResult.alreadyExists("test-msg"));
 
-        assertThat(participantContextService.updateParticipant(context.getParticipantId(), ParticipantContext::deactivate)).isFailed()
+        assertThat(participantContextService.updateParticipant(context.getParticipantContextId(), ParticipantContext::deactivate)).isFailed()
                 .detail().isEqualTo("test-msg");
 
         verify(participantContextStore).findById(anyString());
@@ -390,7 +390,7 @@ private KeyDescriptor.Builder createKey() {
 
     private ParticipantContext createContext() {
         return ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .did("did:web:test-id")
                 .state(ParticipantContextState.CREATED)
                 .apiTokenAlias("test-alias")
diff --git a/core/lib/accesstoken-lib/build.gradle.kts b/core/lib/accesstoken-lib/build.gradle.kts
index 080050cac..7fa901ab4 100644
--- a/core/lib/accesstoken-lib/build.gradle.kts
+++ b/core/lib/accesstoken-lib/build.gradle.kts
@@ -12,5 +12,4 @@ dependencies {
     testImplementation(libs.nimbus.jwt)
     testImplementation(libs.edc.vc.jwt) // JtiValidationRule
     testImplementation(libs.edc.lib.token) // TokenValidationServiceImpl
-    testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
 }
diff --git a/core/lib/credential-query-lib/build.gradle.kts b/core/lib/credential-query-lib/build.gradle.kts
deleted file mode 100644
index 446831225..000000000
--- a/core/lib/credential-query-lib/build.gradle.kts
+++ /dev/null
@@ -1,13 +0,0 @@
-plugins {
-    `java-library`
-}
-
-dependencies {
-    api(project(":spi:identity-hub-store-spi"))
-
-    testImplementation(libs.edc.junit)
-    testImplementation(libs.edc.core.token)
-    testImplementation(libs.nimbus.jwt)
-    testImplementation(testFixtures(project(":spi:identity-hub-spi")))
-
-}
diff --git a/core/lib/keypair-lib/build.gradle.kts b/core/lib/keypair-lib/build.gradle.kts
index 5eceeb8bd..a2b753ec1 100644
--- a/core/lib/keypair-lib/build.gradle.kts
+++ b/core/lib/keypair-lib/build.gradle.kts
@@ -4,7 +4,7 @@ plugins {
 
 dependencies {
     api(libs.edc.lib.keys)
-    implementation(project(":spi:identity-hub-store-spi"))
+    implementation(project(":spi:keypair-spi"))
     implementation(libs.edc.spi.core)
     implementation(libs.edc.lib.util)
     testImplementation(libs.edc.junit)
diff --git a/core/lib/keypair-lib/src/main/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolver.java b/core/lib/keypair-lib/src/main/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolver.java
index c00fc7cf1..31fa80e4c 100644
--- a/core/lib/keypair-lib/src/main/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolver.java
+++ b/core/lib/keypair-lib/src/main/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolver.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.publickey;
 
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.keys.spi.KeyParserRegistry;
 import org.eclipse.edc.keys.spi.LocalPublicKeyService;
 import org.eclipse.edc.spi.monitor.Monitor;
@@ -53,12 +53,12 @@ public KeyPairResourcePublicKeyResolver(KeyPairResourceStore keyPairResourceStor
      * <p>
      * As a fallback, if the PublicKey is not found in storage, the resolver falls back to the {@link LocalPublicKeyService}.
      *
-     * @param publicKeyId   The fully-qualified ID of the public key. For example: {@code did:web:someparticipant#key-123}.
-     * @param participantId The participant ID of the requestor
+     * @param publicKeyId          The fully-qualified ID of the public key. For example: {@code did:web:someparticipant#key-123}.
+     * @param participantContextId The participant context ID of the requestor
      * @return A result with the public key, resolved from storage, or a failed result.
      */
-    public Result<PublicKey> resolveKey(String publicKeyId, String participantId) {
-        var query = ParticipantResource.queryByParticipantId(participantId).filter(new Criterion("keyId", "=", publicKeyId)).build();
+    public Result<PublicKey> resolveKey(String publicKeyId, String participantContextId) {
+        var query = ParticipantResource.queryByParticipantContextId(participantContextId).filter(new Criterion("keyId", "=", publicKeyId)).build();
         var result = keyPairResourceStore.query(query);
         // store failed, e.g. data model does not match query, etc.
         if (result.failed()) {
@@ -73,7 +73,7 @@ public Result<PublicKey> resolveKey(String publicKeyId, String participantId) {
         return resources.stream().findAny()
                 .map(kpr -> parseKey(kpr.getSerializedPublicKey()))
                 .orElseGet(() -> {
-                    monitor.warning("No KeyPairResource with keyId '%s' was found for participant '%s' in the store. Will attempt to resolve from the Vault. ".formatted(publicKeyId, participantId) +
+                    monitor.warning("No KeyPairResource with keyId '%s' was found for participant '%s' in the store. Will attempt to resolve from the Vault. ".formatted(publicKeyId, participantContextId) +
                             "This could be an indication of a data inconsistency, it is recommended to revoke and regenerate keys!");
                     return fallbackResolver.resolveKey(publicKeyId); // attempt to resolve from vault
                 });
diff --git a/core/lib/keypair-lib/src/test/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolverTest.java b/core/lib/keypair-lib/src/test/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolverTest.java
index 4e3e81bd0..aa41194c5 100644
--- a/core/lib/keypair-lib/src/test/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolverTest.java
+++ b/core/lib/keypair-lib/src/test/java/org/eclipse/edc/identityhub/publickey/KeyPairResourcePublicKeyResolverTest.java
@@ -22,7 +22,7 @@
 import com.nimbusds.jose.jwk.gen.OctetKeyPairGenerator;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.keys.KeyParserRegistryImpl;
 import org.eclipse.edc.keys.keyparsers.JwkParser;
 import org.eclipse.edc.keys.spi.KeyParserRegistry;
diff --git a/dist/bom/identityhub-base-bom/build.gradle.kts b/dist/bom/identityhub-base-bom/build.gradle.kts
index be5e3191f..5e3185d15 100644
--- a/dist/bom/identityhub-base-bom/build.gradle.kts
+++ b/dist/bom/identityhub-base-bom/build.gradle.kts
@@ -17,12 +17,12 @@ plugins {
 }
 
 dependencies {
-    runtimeOnly(project(":core:presentation-api"))
     runtimeOnly(project(":core:identity-hub-did"))
     runtimeOnly(project(":core:identity-hub-core"))
     runtimeOnly(project(":core:identity-hub-participants"))
     runtimeOnly(project(":core:identity-hub-keypairs"))
     runtimeOnly(project(":extensions:did:local-did-publisher"))
+    runtimeOnly(project(":extensions:protocols:dcp:presentation-api"))
     runtimeOnly(project(":extensions:common:credential-watchdog"))
     runtimeOnly(project(":extensions:sts:sts-account-provisioner"))
     runtimeOnly(project(":extensions:api:identity-api:did-api"))
@@ -35,6 +35,7 @@ dependencies {
     runtimeOnly(libs.edc.identity.did.core)
     runtimeOnly(libs.edc.core.token)
     runtimeOnly(libs.edc.api.version)
+    runtimeOnly(libs.edc.transaction.local) // needed by the PresentationCreatorRegistry
 
     runtimeOnly(libs.edc.identity.did.web)
     runtimeOnly(libs.edc.jsonld)
diff --git a/dist/bom/identityhub-feature-sql-bom/build.gradle.kts b/dist/bom/identityhub-feature-sql-bom/build.gradle.kts
index 0e5324690..ab451c7d0 100644
--- a/dist/bom/identityhub-feature-sql-bom/build.gradle.kts
+++ b/dist/bom/identityhub-feature-sql-bom/build.gradle.kts
@@ -25,8 +25,8 @@ dependencies {
     api(project(":extensions:store:sql:identity-hub-participantcontext-store-sql"))
 
     api(libs.edc.sql.core)
+    api(libs.edc.transaction.local)
     api(libs.edc.sql.pool)
-    api(libs.edc.sql.transactionlocal)
     api(libs.edc.sql.bootstrapper)
     api(libs.edc.sql.jtivdalidation)
 
diff --git a/docs/developer/architecture/identity-api.security.md b/docs/developer/architecture/identity-api.security.md
index d39d045a8..c234057f6 100644
--- a/docs/developer/architecture/identity-api.security.md
+++ b/docs/developer/architecture/identity-api.security.md
@@ -10,7 +10,7 @@
   single individual within that company / participant. **Individual users don't exist as first-level concept in
   IdentityHub!**
 - _Participant context_: this is the unit of management, that owns all resources. Its identifier must be equal to
-  the `participantId` that is defined
+  the `participantContextId` that is defined
   in [DSP](https://github.com/International-Data-Spaces-Association/ids-specification). For the purposes of Identity
   API operations, IdentityHub assumes the ID of the `ParticipantContext` to be equal to the ID of
   the `ServicePrincipal`.
@@ -123,7 +123,7 @@ Unfortunately it is not possible to derive that information from request context
 certain amount of guess work to determine which part of the request path is the resource ID, take this path for example:
 
 ```
-/v1/participants/<participantId>/keypairs/<keypairId>
+/v1/participants/<participantContextId>/keypairs/<keypairId>
 ```
 
 While it would be _theoretically_ possible to employ a string parsing method, where we interpret the third path
@@ -148,7 +148,7 @@ public KeyPairResource findById(@PathParam("keyPairId") String id, @Context Secu
 }
 ```
 
-Here, the `AuthorizationService` is consulted to determine whether `participantId` is permitted to access
+Here, the `AuthorizationService` is consulted to determine whether `participantContextId` is permitted to access
 a `KeyPairResource` with `id`.
 
 > There is one exception to this, which is authorizing [built-in roles](#51-built-in-roles).
diff --git a/e2e-tests/api-tests/build.gradle.kts b/e2e-tests/api-tests/build.gradle.kts
index 2ae4b9d8f..9dcf54e87 100644
--- a/e2e-tests/api-tests/build.gradle.kts
+++ b/e2e-tests/api-tests/build.gradle.kts
@@ -5,7 +5,6 @@ plugins {
 
 dependencies {
     testImplementation(project(":spi:identity-hub-spi"))
-    testImplementation(project(":spi:identity-hub-store-spi"))
     testImplementation(project(":core:identity-hub-participants"))
     testImplementation(libs.edc.junit)
     testImplementation(libs.restAssured)
@@ -14,7 +13,6 @@ dependencies {
     testImplementation(libs.testcontainers.postgres)
 
     // needed for the Participant
-    testImplementation(project(":core:lib:credential-query-lib"))
     testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
     testImplementation(testFixtures(libs.edc.testfixtures.managementapi))
     testImplementation(testFixtures(libs.edc.sql.test.fixtures))
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/DidManagementApiEndToEndTest.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/DidManagementApiEndToEndTest.java
index 807ee9f7d..e6441a77d 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/DidManagementApiEndToEndTest.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/DidManagementApiEndToEndTest.java
@@ -17,12 +17,12 @@
 import io.restassured.http.Header;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.identitytrust.sts.spi.store.StsAccountStore;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentPublished;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentUnpublished;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentPublished;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentUnpublished;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext;
 import org.eclipse.edc.junit.annotations.EndToEndTest;
@@ -57,7 +57,7 @@ void tearDown(ParticipantContextService pcService, DidResourceStore didResourceS
             // purge all users, dids, keypairs
 
             pcService.query(QuerySpec.max()).getContent()
-                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantId()).getContent());
+                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantContextId()).getContent());
 
             didResourceStore.query(QuerySpec.max()).forEach(dr -> didResourceStore.deleteById(dr.getDid()).getContent());
 
@@ -80,7 +80,7 @@ void publishDid_notOwner_expect403(IdentityHubEndToEndTestContext context, Event
             // create second user
             var user2 = "user2";
             var user2Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user2)
+                    .participantContextId(user2)
                     .did("did:web:" + user2)
                     .apiTokenAlias(user2 + "-alias")
                     .build();
@@ -188,7 +188,7 @@ void unpublishDid_notOwner_expect403(IdentityHubEndToEndTestContext context, Eve
             // create second user
             var user2 = "user2";
             var user2Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user2)
+                    .participantContextId(user2)
                     .did("did:web:" + user2)
                     .apiTokenAlias(user2 + "-alias")
                     .build();
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/KeyPairResourceApiEndToEndTest.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/KeyPairResourceApiEndToEndTest.java
index 218b967e3..821ea2667 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/KeyPairResourceApiEndToEndTest.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/KeyPairResourceApiEndToEndTest.java
@@ -17,18 +17,18 @@
 import io.restassured.http.ContentType;
 import io.restassured.http.Header;
 import org.eclipse.edc.iam.identitytrust.sts.spi.store.StsAccountStore;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentPublished;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentPublished;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairActivated;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairAdded;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRevoked;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRotated;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext;
 import org.eclipse.edc.junit.annotations.EndToEndTest;
@@ -72,7 +72,7 @@ void tearDown(ParticipantContextService pcService, DidResourceStore didResourceS
             // purge all users, dids, keypairs
 
             pcService.query(QuerySpec.max()).getContent()
-                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantId()).getContent());
+                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantContextId()).getContent());
 
             didResourceStore.query(QuerySpec.max()).forEach(dr -> didResourceStore.deleteById(dr.getDid()).getContent());
 
@@ -91,7 +91,7 @@ void findById_notAuthorized(IdentityHubEndToEndTestContext context) {
             // create second user
             var user2 = "user2";
             var user2Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user2)
+                    .participantContextId(user2)
                     .did("did:web:" + user2)
                     .apiTokenAlias(user2 + "-alias")
                     .build();
@@ -137,7 +137,7 @@ void findForParticipant_notAuthorized(IdentityHubEndToEndTestContext context) {
             // create second user
             var user2 = "user2";
             var user2Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user2)
+                    .participantContextId(user2)
                     .did("did:web:" + user2)
                     .apiTokenAlias(user2 + "-alias")
                     .build();
@@ -184,30 +184,30 @@ void addKeyPair(IdentityHubEndToEndTestContext context, EventRouter router) {
             var subscriber = mock(EventSubscriber.class);
             router.registerSync(KeyPairAdded.class, subscriber);
 
-            var participantId = "user1";
-            var token = context.createParticipant(participantId);
+            var participantContextId = "user1";
+            var token = context.createParticipant(participantContextId);
 
             assertThat(Arrays.asList(token, superUserKey))
                     .allSatisfy(t -> {
-                        var keyDesc = context.createKeyDescriptor(participantId)
+                        var keyDesc = context.createKeyDescriptor(participantContextId)
                                 .keyId(UUID.randomUUID().toString())
                                 .build();
                         context.getIdentityApiEndpoint().baseRequest()
                                 .contentType(JSON)
                                 .header(new Header("x-api-key", t))
                                 .body(keyDesc)
-                                .put("/v1alpha/participants/%s/keypairs".formatted(toBase64(participantId)))
+                                .put("/v1alpha/participants/%s/keypairs".formatted(toBase64(participantContextId)))
                                 .then()
                                 .log().ifValidationFails()
                                 .statusCode(204)
                                 .body(notNullValue());
 
-                        assertThat(context.getKeyPairsForParticipant(participantId))
+                        assertThat(context.getKeyPairsForParticipant(participantContextId))
                                 .hasSizeGreaterThanOrEqualTo(2)
                                 .anyMatch(kpr -> kpr.getKeyId().equals(keyDesc.getKeyId()));
                         verify(subscriber).on(argThat(env -> {
                             var evt = (KeyPairAdded) env.getPayload();
-                            return evt.getParticipantId().equals(participantId) &&
+                            return evt.getParticipantContextId().equals(participantContextId) &&
                                     evt.getKeyPairResource().getId().equals(keyDesc.getResourceId()) &&
                                     evt.getKeyId().equals(keyDesc.getKeyId());
                         }));
@@ -359,7 +359,7 @@ void rotate_withSuperUserToken(IdentityHubEndToEndTestContext context, EventRout
             // verify that the "rotated" event fired once
             verify(subscriber).on(argThat(env -> {
                 if (env.getPayload() instanceof KeyPairRotated evt) {
-                    return evt.getParticipantId().equals(user1);
+                    return evt.getParticipantContextId().equals(user1);
                 }
                 return false;
             }));
@@ -374,7 +374,7 @@ void rotate_withSuperUserToken(IdentityHubEndToEndTestContext context, EventRout
         }
 
         @ParameterizedTest(name = "New KeyID {0}")
-        @ValueSource(strings = { "did:web:user1#new-key-id", "new-key-id" })
+        @ValueSource(strings = {"did:web:user1#new-key-id", "new-key-id"})
         void rotate_withUserToken(String keyId, IdentityHubEndToEndTestContext context, EventRouter router, StsAccountStore accountStore) {
             var subscriber = mock(EventSubscriber.class);
             router.registerSync(KeyPairRotated.class, subscriber);
@@ -403,7 +403,7 @@ void rotate_withUserToken(String keyId, IdentityHubEndToEndTestContext context,
             // verify that the "rotated" event fired once
             verify(subscriber).on(argThat(env -> {
                 if (env.getPayload() instanceof KeyPairRotated evt) {
-                    return evt.getParticipantId().equals(participantId);
+                    return evt.getParticipantContextId().equals(participantId);
                 }
                 return false;
             }));
@@ -450,7 +450,7 @@ void rotate_withoutNewKey(IdentityHubEndToEndTestContext context, EventRouter ro
             // verify that the "rotated" event fired once
             verify(subscriber).on(argThat(env -> {
                 if (env.getPayload() instanceof KeyPairRotated evt) {
-                    return evt.getParticipantId().equals(participantId);
+                    return evt.getParticipantContextId().equals(participantId);
                 }
                 return false;
             }));
@@ -493,7 +493,7 @@ void rotate_notAuthorized(IdentityHubEndToEndTestContext context, EventRouter ro
             // make sure that the event to add the _new_ keypair was never fired
             verify(subscriber, never()).on(argThat(env -> {
                 if (env.getPayload() instanceof KeyPairRotated evt) {
-                    return evt.getParticipantId().equals(user1) && evt.getKeyPairResource().equals(keyDesc.getKeyId());
+                    return evt.getParticipantContextId().equals(user1) && evt.getKeyPairResource().equals(keyDesc.getKeyId());
                 }
                 return false;
             }));
@@ -582,7 +582,7 @@ void rotate_withNewKey_whenDidNotPublished_shouldNotUpdate(IdentityHubEndToEndTe
         }
 
         @ParameterizedTest(name = "New Key-ID: {0}")
-        @ValueSource(strings = { "new-keyId", "did:web:user1#new-keyId" })
+        @ValueSource(strings = {"new-keyId", "did:web:user1#new-keyId"})
         void revoke(String newKeyId, IdentityHubEndToEndTestContext context, StsAccountStore accountStore) {
             var superUserKey = context.createSuperUser();
             var participantId = "user1";
@@ -643,7 +643,7 @@ void revoke_withoutNewKey(IdentityHubEndToEndTestContext context, EventRouter ro
             // verify that the "rotated" event fired once
             verify(subscriber).on(argThat(env -> {
                 if (env.getPayload() instanceof KeyPairRevoked evt) {
-                    return evt.getParticipantId().equals(participantId);
+                    return evt.getParticipantContextId().equals(participantId);
                 }
                 return false;
             }));
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/ParticipantContextApiEndToEndTest.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/ParticipantContextApiEndToEndTest.java
index e10bc8bcd..1982d5a10 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/ParticipantContextApiEndToEndTest.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/ParticipantContextApiEndToEndTest.java
@@ -18,21 +18,21 @@
 import io.restassured.http.Header;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.identitytrust.sts.spi.store.StsAccountStore;
-import org.eclipse.edc.identithub.spi.did.DidConstants;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisher;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentPublished;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidConstants;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisher;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentPublished;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextCreated;
 import org.eclipse.edc.identityhub.spi.participantcontext.events.ParticipantContextUpdated;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext;
 import org.eclipse.edc.junit.annotations.EndToEndTest;
@@ -82,7 +82,7 @@ void tearDown(ParticipantContextService pcService, DidResourceStore didResourceS
             // purge all users, dids, keypairs
 
             pcService.query(QuerySpec.max()).getContent()
-                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantId()).getContent());
+                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantContextId()).getContent());
 
             didResourceStore.query(QuerySpec.max()).forEach(dr -> didResourceStore.deleteById(dr.getDid()).getContent());
 
@@ -103,14 +103,14 @@ void getUserById(IdentityHubEndToEndTestContext context) {
                     .then()
                     .statusCode(200)
                     .extract().body().as(ParticipantContext.class);
-            assertThat(su.getParticipantId()).isEqualTo(SUPER_USER);
+            assertThat(su.getParticipantContextId()).isEqualTo(SUPER_USER);
         }
 
         @Test
         void getUserById_notOwner_expect403(IdentityHubEndToEndTestContext context) {
             var user1 = "user1";
             var user1Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user1)
+                    .participantContextId(user1)
                     .did("did:web:" + user1)
                     .apiTokenAlias(user1 + "-alias")
                     .build();
@@ -118,7 +118,7 @@ void getUserById_notOwner_expect403(IdentityHubEndToEndTestContext context) {
 
             var user2 = "user2";
             var user2Context = ParticipantContext.Builder.newInstance()
-                    .participantId(user2)
+                    .participantContextId(user2)
                     .did("did:web:" + user2)
                     .apiTokenAlias(user2 + "-alias")
                     .build();
@@ -154,7 +154,7 @@ void createNewUser_principalIsSuperuser(IdentityHubEndToEndTestContext context,
                     .body("apiKey", notNullValue())
                     .body("clientSecret", notNullValue());
 
-            verify(subscriber).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantId().equals(manifest.getParticipantId())));
+            verify(subscriber).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantContextId().equals(manifest.getParticipantId())));
 
             assertThat(context.getKeyPairsForParticipant(manifest.getParticipantId())).hasSize(1);
             assertThat(context.getDidForParticipant(manifest.getParticipantId())).hasSize(1)
@@ -187,7 +187,7 @@ void createNewUser_whenKeyPairActive(IdentityHubEndToEndTestContext context, Eve
                     .statusCode(anyOf(equalTo(200), equalTo(204)))
                     .body(notNullValue());
 
-            verify(subscriber).on(argThat(env -> env.getPayload() instanceof ParticipantContextCreated created && created.getParticipantId().equals(manifest.getParticipantId())));
+            verify(subscriber).on(argThat(env -> env.getPayload() instanceof ParticipantContextCreated created && created.getParticipantContextId().equals(manifest.getParticipantId())));
             verify(subscriber, times(1)).on(argThat(evt -> evt.getPayload() instanceof DidDocumentPublished));
 
             assertThat(context.getKeyPairsForParticipant(manifest.getParticipantId())).hasSize(1)
@@ -248,7 +248,7 @@ void createNewUser_whenKeyPairNotActive(IdentityHubEndToEndTestContext context,
                     .statusCode(anyOf(equalTo(200), equalTo(204)))
                     .body(notNullValue());
 
-            verify(subscriber).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantId().equals(manifest.getParticipantId())));
+            verify(subscriber).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantContextId().equals(manifest.getParticipantId())));
 
             assertThat(context.getKeyPairsForParticipant(manifest.getParticipantId())).hasSize(1)
                     .allSatisfy(kpr -> assertThat(kpr.getState()).isEqualTo(KeyPairState.CREATED.code()));
@@ -267,7 +267,7 @@ void createNewUser_principalIsNotSuperuser_expect403(IdentityHubEndToEndTestCont
 
             var principal = "another-user";
             var anotherUser = ParticipantContext.Builder.newInstance()
-                    .participantId(principal)
+                    .participantContextId(principal)
                     .did("did:web:" + principal)
                     .apiTokenAlias(principal + "-alias")
                     .build();
@@ -328,7 +328,7 @@ void createNewUser_whenDidAlreadyExists_expect409(IdentityHubEndToEndTestContext
                     .log().ifValidationFails()
                     .statusCode(409);
 
-            verify(subscriber, never()).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantId().equals(manifest.getParticipantId())));
+            verify(subscriber, never()).on(argThat(env -> ((ParticipantContextCreated) env.getPayload()).getParticipantContextId().equals(manifest.getParticipantId())));
         }
 
         @Test
@@ -413,7 +413,7 @@ void activateParticipant_principalIsSuperser(IdentityHubEndToEndTestContext cont
             // verify the correct event was emitted
             verify(subscriber).on(argThat(env -> {
                 var evt = (ParticipantContextUpdated) env.getPayload();
-                return evt.getParticipantId().equals(participantId) && evt.getNewState() == ParticipantContextState.ACTIVATED;
+                return evt.getParticipantContextId().equals(participantId) && evt.getNewState() == ParticipantContextState.ACTIVATED;
             }));
         }
 
@@ -423,53 +423,53 @@ void deactivateParticipant_shouldUnpublishDid(IdentityHubEndToEndTestContext con
             var subscriber = mock(EventSubscriber.class);
             router.registerSync(ParticipantContextUpdated.class, subscriber);
 
-            var participantId = "test-user";
-            var did = "did:web:" + participantId;
+            var participantContextId = "test-user";
+            var did = "did:web:" + participantContextId;
 
-            context.createParticipant(participantId);
+            context.createParticipant(participantContextId);
             assertThat(context.getDidResourceForParticipant(did).getState()).isEqualTo(DidState.PUBLISHED.code());
 
             context.getIdentityApiEndpoint().baseRequest()
                     .header(new Header("x-api-key", superUserKey))
                     .contentType(ContentType.JSON)
-                    .post("/v1alpha/participants/%s/state?isActive=false".formatted(toBase64(participantId)))
+                    .post("/v1alpha/participants/%s/state?isActive=false".formatted(toBase64(participantContextId)))
                     .then()
                     .log().ifError()
                     .statusCode(204);
 
-            var updatedParticipant = participantContextService.getParticipantContext(participantId).orElseThrow(f -> new EdcException(f.getFailureDetail()));
+            var updatedParticipant = participantContextService.getParticipantContext(participantContextId).orElseThrow(f -> new EdcException(f.getFailureDetail()));
             assertThat(updatedParticipant.getState()).isEqualTo(ParticipantContextState.DEACTIVATED.ordinal());
             assertThat(context.getDidResourceForParticipant(did).getState()).isEqualTo(DidState.UNPUBLISHED.code());
 
             // verify the correct event was emitted
             verify(subscriber).on(argThat(env -> {
                 var evt = (ParticipantContextUpdated) env.getPayload();
-                return evt.getParticipantId().equals(participantId) && evt.getNewState() == ParticipantContextState.DEACTIVATED;
+                return evt.getParticipantContextId().equals(participantContextId) && evt.getNewState() == ParticipantContextState.DEACTIVATED;
             }));
         }
 
         @Test
         void deleteParticipant(IdentityHubEndToEndTestContext context, Vault vault) {
             var superUserKey = context.createSuperUser();
-            var participantId = "another-user";
-            context.createParticipant(participantId);
-            assertThat(context.getDidForParticipant(participantId)).hasSize(1);
+            var participantContextId = "another-user";
+            context.createParticipant(participantContextId);
+            assertThat(context.getDidForParticipant(participantContextId)).hasSize(1);
 
-            var pc = context.getParticipant(participantId);
-            var alias = context.getKeyPairsForParticipant(participantId).stream().findFirst().map(KeyPairResource::getPrivateKeyAlias).orElseThrow();
+            var pc = context.getParticipant(participantContextId);
+            var alias = context.getKeyPairsForParticipant(participantContextId).stream().findFirst().map(KeyPairResource::getPrivateKeyAlias).orElseThrow();
             var apiTokenAlias = pc.getApiTokenAlias();
 
 
             context.getIdentityApiEndpoint().baseRequest()
                     .header(new Header("x-api-key", superUserKey))
                     .contentType(ContentType.JSON)
-                    .delete("/v1alpha/participants/%s".formatted(toBase64(participantId)))
+                    .delete("/v1alpha/participants/%s".formatted(toBase64(participantContextId)))
                     .then()
                     .log().ifError()
                     .statusCode(204);
 
-            assertThat(context.getDidForParticipant(participantId)).isEmpty();
-            assertThat(context.getKeyPairsForParticipant(participantId)).isEmpty();
+            assertThat(context.getDidForParticipant(participantContextId)).isEmpty();
+            assertThat(context.getKeyPairsForParticipant(participantContextId)).isEmpty();
             assertThat(vault.resolveSecret(alias)).isNull();
             assertThat(vault.resolveSecret(apiTokenAlias)).isNull();
         }
@@ -477,14 +477,14 @@ void deleteParticipant(IdentityHubEndToEndTestContext context, Vault vault) {
         @Test
         void regenerateToken(IdentityHubEndToEndTestContext context) {
             var superUserKey = context.createSuperUser();
-            var participantId = "another-user";
-            var userToken = context.createParticipant(participantId);
+            var participantContextId = "another-user";
+            var userToken = context.createParticipant(participantContextId);
 
             assertThat(Arrays.asList(userToken, superUserKey))
                     .allSatisfy(t -> context.getIdentityApiEndpoint().baseRequest()
                             .header(new Header("x-api-key", t))
                             .contentType(ContentType.JSON)
-                            .post("/v1alpha/participants/%s/token".formatted(toBase64(participantId)))
+                            .post("/v1alpha/participants/%s/token".formatted(toBase64(participantContextId)))
                             .then()
                             .log().ifError()
                             .statusCode(200)
@@ -494,32 +494,32 @@ void regenerateToken(IdentityHubEndToEndTestContext context) {
         @Test
         void updateRoles(IdentityHubEndToEndTestContext context) {
             var superUserKey = context.createSuperUser();
-            var participantId = "some-user";
-            context.createParticipant(participantId);
+            var participantContextId = "some-user";
+            context.createParticipant(participantContextId);
 
             context.getIdentityApiEndpoint().baseRequest()
                     .header(new Header("x-api-key", superUserKey))
                     .contentType(ContentType.JSON)
                     .body(List.of("role1", "role2", "admin"))
-                    .put("/v1alpha/participants/%s/roles".formatted(toBase64(participantId)))
+                    .put("/v1alpha/participants/%s/roles".formatted(toBase64(participantContextId)))
                     .then()
                     .log().ifError()
                     .statusCode(204);
 
-            assertThat(context.getParticipant(participantId).getRoles()).containsExactlyInAnyOrder("role1", "role2", "admin");
+            assertThat(context.getParticipant(participantContextId).getRoles()).containsExactlyInAnyOrder("role1", "role2", "admin");
         }
 
         @ParameterizedTest(name = "Expect 403, role = {0}")
-        @ValueSource(strings = { "some-role", "admin" })
+        @ValueSource(strings = {"some-role", "admin"})
         void updateRoles_whenNotSuperuser(String role, IdentityHubEndToEndTestContext context) {
-            var participantId = "some-user";
-            var userToken = context.createParticipant(participantId);
+            var participantContextId = "some-user";
+            var userToken = context.createParticipant(participantContextId);
 
             context.getIdentityApiEndpoint().baseRequest()
                     .header(new Header("x-api-key", userToken))
                     .contentType(ContentType.JSON)
                     .body(List.of(role))
-                    .put("/v1alpha/participants/%s/roles".formatted(toBase64(participantId)))
+                    .put("/v1alpha/participants/%s/roles".formatted(toBase64(participantContextId)))
                     .then()
                     .log().ifError()
                     .statusCode(403);
@@ -530,8 +530,8 @@ void getAll(IdentityHubEndToEndTestContext context) {
             var superUserKey = context.createSuperUser();
             range(0, 10)
                     .forEach(i -> {
-                        var participantId = "user" + i;
-                        context.createParticipant(participantId);
+                        var participantContextId = "user" + i;
+                        context.createParticipant(participantContextId);
                     });
             var found = context.getIdentityApiEndpoint().baseRequest()
                     .contentType(JSON)
@@ -549,8 +549,8 @@ void getAll_withPaging(IdentityHubEndToEndTestContext context) {
             var superUserKey = context.createSuperUser();
             range(0, 10)
                     .forEach(i -> {
-                        var participantId = "user" + i;
-                        context.createParticipant(participantId); // implicitly creates a keypair
+                        var participantContextId = "user" + i;
+                        context.createParticipant(participantContextId); // implicitly creates a keypair
                     });
             var found = context.getIdentityApiEndpoint().baseRequest()
                     .contentType(JSON)
@@ -568,8 +568,8 @@ void getAll_withDefaultPaging(IdentityHubEndToEndTestContext context) {
             var superUserKey = context.createSuperUser();
             IntStream.range(0, 70)
                     .forEach(i -> {
-                        var participantId = "user" + i;
-                        context.createParticipant(participantId); // implicitly creates a keypair
+                        var participantContextId = "user" + i;
+                        context.createParticipant(participantContextId); // implicitly creates a keypair
                     });
             var found = context.getIdentityApiEndpoint().baseRequest()
                     .contentType(JSON)
@@ -588,8 +588,8 @@ void getAll_notAuthorized(IdentityHubEndToEndTestContext context) {
 
             range(0, 10)
                     .forEach(i -> {
-                        var participantId = "user" + i;
-                        context.createParticipant(participantId); // implicitly creates a keypair
+                        var participantContextId = "user" + i;
+                        context.createParticipant(participantContextId); // implicitly creates a keypair
                     });
             context.getIdentityApiEndpoint().baseRequest()
                     .contentType(JSON)
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/PresentationApiEndToEndTest.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/PresentationApiEndToEndTest.java
index a749754ba..0e4d6ab66 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/PresentationApiEndToEndTest.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/PresentationApiEndToEndTest.java
@@ -33,14 +33,14 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.RevocationServiceRegistry;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubCustomizableEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext;
@@ -139,7 +139,7 @@ void teardown(ParticipantContextService contextService, DidResourceStore didReso
             // purge all participant contexts
 
             contextService.query(QuerySpec.max()).getContent()
-                    .forEach(pc -> contextService.deleteParticipantContext(pc.getParticipantId()).getContent());
+                    .forEach(pc -> contextService.deleteParticipantContext(pc.getParticipantContextId()).getContent());
 
             didResourceStore.query(QuerySpec.max()).forEach(dr -> didResourceStore.deleteById(dr.getDid()).getContent());
 
@@ -272,7 +272,7 @@ void query_credentialQueryResolverFails_shouldReturn403(IdentityHubEndToEndTestC
                     .credential(new VerifiableCredentialContainer(TestData.VC_EXAMPLE, CredentialFormat.VC1_0_JWT, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
             store.create(res);
 
@@ -283,7 +283,7 @@ void query_credentialQueryResolverFails_shouldReturn403(IdentityHubEndToEndTestC
                     .credential(new VerifiableCredentialContainer(TestData.VC_EXAMPLE_2, CredentialFormat.VC1_0_JWT, cred2))
                     .issuerId("https://example.edu/issuers/12345")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
             store.create(res2);
 
@@ -334,7 +334,7 @@ void query_success_containsCredential(IdentityHubEndToEndTestContext context, Cr
                     .credential(new VerifiableCredentialContainer(TestData.VC_EXAMPLE, CredentialFormat.VC1_0_JWT, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
 
             store.create(res);
@@ -375,7 +375,7 @@ void query_success_containsEnvelopedCredential(IdentityHubEndToEndTestContext co
                     .credential(new VerifiableCredentialContainer(TestData.JWT_VC_EXAMPLE, CredentialFormat.VC2_0_JOSE, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
 
             store.create(res);
@@ -406,7 +406,7 @@ void query_success_containsEnvelopedCredential(IdentityHubEndToEndTestContext co
         }
 
         @ParameterizedTest(name = "VcState code: {0}")
-        @ValueSource(ints = { 600, 700, 800, 900 })
+        @ValueSource(ints = {600, 700, 800, 900})
         void query_shouldFilterOutInvalidCreds(int vcStateCode, IdentityHubEndToEndTestContext context, CredentialStore store) throws JOSEException, JsonProcessingException {
 
             // modify VC content, so that it becomes either not-yet-valid or expired
@@ -436,7 +436,7 @@ void query_shouldFilterOutInvalidCreds(int vcStateCode, IdentityHubEndToEndTestC
                     .credential(new VerifiableCredentialContainer(vcContent, CredentialFormat.VC1_0_JWT, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
             store.create(res);
 
@@ -475,7 +475,7 @@ void query_accessTokenKeyIdDoesNotBelongToParticipant_shouldReturn401(IdentityHu
                     .credential(new VerifiableCredentialContainer(TestData.VC_EXAMPLE, CredentialFormat.VC1_0_JWT, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
 
             store.create(res);
@@ -504,7 +504,7 @@ void query_accessTokenAudienceDoesNotBelongToParticipant_shouldReturn401(Identit
                     .credential(new VerifiableCredentialContainer(TestData.VC_EXAMPLE, CredentialFormat.VC1_0_JWT, cred))
                     .issuerId("https://example.edu/issuers/565049")
                     .holderId("did:example:ebfeb1f712ebc6f1c276e12ec21")
-                    .participantId(TEST_PARTICIPANT_CONTEXT_ID)
+                    .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                     .build();
 
             store.create(res);
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/VerifiableCredentialApiEndToEndTest.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/VerifiableCredentialApiEndToEndTest.java
index 91c234a1c..9fc222f94 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/VerifiableCredentialApiEndToEndTest.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/VerifiableCredentialApiEndToEndTest.java
@@ -19,9 +19,9 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialManifest;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndExtension;
 import org.eclipse.edc.identityhub.tests.fixtures.IdentityHubEndToEndTestContext;
@@ -51,7 +51,7 @@ void tearDown(ParticipantContextService pcService, DidResourceStore didResourceS
             // purge all users, dids, keypairs
 
             pcService.query(QuerySpec.max()).getContent()
-                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantId()).getContent());
+                    .forEach(pc -> pcService.deleteParticipantContext(pc.getParticipantContextId()).getContent());
 
             didResourceStore.query(QuerySpec.max()).forEach(dr -> didResourceStore.deleteById(dr.getDid()).getContent());
 
@@ -204,10 +204,10 @@ private String toBase64(String s) {
             return Base64.getUrlEncoder().encodeToString(s.getBytes());
         }
 
-        private VerifiableCredentialManifest.Builder createManifest(String participantId, VerifiableCredential vc) {
+        private VerifiableCredentialManifest.Builder createManifest(String participantContextId, VerifiableCredential vc) {
             return VerifiableCredentialManifest.Builder.newInstance()
                     .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, vc))
-                    .participantId(participantId);
+                    .participantContextId(participantContextId);
         }
 
     }
diff --git a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/fixtures/IdentityHubEndToEndTestContext.java b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/fixtures/IdentityHubEndToEndTestContext.java
index 84b7a7b52..aed89493f 100644
--- a/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/fixtures/IdentityHubEndToEndTestContext.java
+++ b/e2e-tests/api-tests/src/test/java/org/eclipse/edc/identityhub/tests/fixtures/IdentityHubEndToEndTestContext.java
@@ -22,22 +22,22 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.Issuer;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
 import org.eclipse.edc.identityhub.participantcontext.ApiTokenGenerator;
 import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.junit.extensions.EmbeddedRuntime;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.query.Criterion;
@@ -70,21 +70,21 @@ public EmbeddedRuntime getRuntime() {
         return runtime;
     }
 
-    public String createParticipant(String participantId) {
-        return createParticipant(participantId, List.of());
+    public String createParticipant(String participantContextId) {
+        return createParticipant(participantContextId, List.of());
     }
 
-    public String createParticipant(String participantId, List<String> roles, boolean isActive) {
+    public String createParticipant(String participantContextId, List<String> roles, boolean isActive) {
         var manifest = ParticipantManifest.Builder.newInstance()
-                .participantId(participantId)
+                .participantId(participantContextId)
                 .active(isActive)
                 .roles(roles)
                 .serviceEndpoint(new Service("test-service-id", "test-type", "http://foo.bar.com"))
-                .did("did:web:" + participantId)
+                .did("did:web:" + participantContextId)
                 .key(KeyDescriptor.Builder.newInstance()
-                        .privateKeyAlias(participantId + "-alias")
-                        .resourceId(participantId + "-resource")
-                        .keyId(participantId + "-key")
+                        .privateKeyAlias(participantContextId + "-alias")
+                        .resourceId(participantContextId + "-resource")
+                        .keyId(participantContextId + "-key")
                         .keyGeneratorParams(Map.of("algorithm", "EC", "curve", "secp256r1"))
                         .build())
                 .build();
@@ -95,8 +95,8 @@ public String createParticipant(String participantId, List<String> roles, boolea
     }
 
 
-    public String createParticipant(String participantId, List<String> roles) {
-        return createParticipant(participantId, roles, true);
+    public String createParticipant(String participantContextId, List<String> roles) {
+        return createParticipant(participantContextId, roles, true);
     }
 
     public VerifiableCredential createCredential() {
@@ -109,11 +109,11 @@ public VerifiableCredential createCredential() {
                 .build();
     }
 
-    public String storeCredential(VerifiableCredential credential, String participantId) {
+    public String storeCredential(VerifiableCredential credential, String participantContextId) {
         var resource = VerifiableCredentialResource.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
                 .state(VcStatus.ISSUED)
-                .participantId(participantId)
+                .participantContextId(participantContextId)
                 .holderId("holderId")
                 .issuerId("issuerId")
                 .credential(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, credential))
@@ -131,7 +131,7 @@ public String storeParticipant(ParticipantContext pc) {
         var store = runtime.getService(ParticipantContextStore.class);
 
         var vault = runtime.getService(Vault.class);
-        var token = createTokenFor(pc.getParticipantId());
+        var token = createTokenFor(pc.getParticipantContextId());
         vault.storeSecret(pc.getApiTokenAlias(), token);
         store.create(pc).orElseThrow(f -> new RuntimeException(f.getFailureDetail()));
         return token;
@@ -145,38 +145,38 @@ public IdentityHubRuntimeConfiguration.Endpoint getPresentationEndpoint() {
         return configuration.getPresentationEndpoint();
     }
 
-    public Collection<DidDocument> getDidForParticipant(String participantId) {
+    public Collection<DidDocument> getDidForParticipant(String participantContextId) {
         return runtime.getService(DidDocumentService.class).queryDocuments(QuerySpec.Builder.newInstance()
-                .filter(new Criterion("participantId", "=", participantId))
+                .filter(new Criterion("participantContextId", "=", participantContextId))
                 .build()).getContent();
     }
 
-    public Collection<KeyPairResource> getKeyPairsForParticipant(String participantId) {
-        return runtime.getService(KeyPairResourceStore.class).query(ParticipantResource.queryByParticipantId(participantId).build())
+    public Collection<KeyPairResource> getKeyPairsForParticipant(String participantContextId) {
+        return runtime.getService(KeyPairResourceStore.class).query(ParticipantResource.queryByParticipantContextId(participantContextId).build())
                 .getContent();
     }
 
-    public KeyDescriptor createKeyPair(String participantId) {
+    public KeyDescriptor createKeyPair(String participantContextId) {
 
-        var descriptor = createKeyDescriptor(participantId).build();
-        return createKeyPair(participantId, descriptor);
+        var descriptor = createKeyDescriptor(participantContextId).build();
+        return createKeyPair(participantContextId, descriptor);
     }
 
-    public KeyDescriptor createKeyPair(String participantId, KeyDescriptor descriptor) {
+    public KeyDescriptor createKeyPair(String participantContextId, KeyDescriptor descriptor) {
         var service = runtime.getService(KeyPairService.class);
-        service.addKeyPair(participantId, descriptor, true)
+        service.addKeyPair(participantContextId, descriptor, true)
                 .orElseThrow(f -> new EdcException(f.getFailureDetail()));
         return descriptor;
     }
 
-    public KeyDescriptor.Builder createKeyDescriptor(String participantId) {
+    public KeyDescriptor.Builder createKeyDescriptor(String participantContextId) {
         var keyId = "key-id-%s".formatted(UUID.randomUUID());
         return KeyDescriptor.Builder.newInstance()
                 .keyId(keyId)
                 .active(false)
                 .resourceId(UUID.randomUUID().toString())
                 .keyGeneratorParams(Map.of("algorithm", "EC", "curve", Curve.P_384.getStdName()))
-                .privateKeyAlias("%s-%s-alias".formatted(participantId, keyId));
+                .privateKeyAlias("%s-%s-alias".formatted(participantContextId, keyId));
     }
 
     public ParticipantManifest.Builder createNewParticipant() {
@@ -199,9 +199,9 @@ public String createTokenFor(String userId) {
         return new ApiTokenGenerator().generate(userId);
     }
 
-    public ParticipantContext getParticipant(String participantId) {
+    public ParticipantContext getParticipant(String participantContextId) {
         return runtime.getService(ParticipantContextService.class)
-                .getParticipantContext(participantId)
+                .getParticipantContext(participantContextId)
                 .orElseThrow(f -> new EdcException(f.getFailureDetail()));
     }
 
diff --git a/e2e-tests/bom-tests/src/test/java/org/eclipse/edc/test/bom/BomSmokeTests.java b/e2e-tests/bom-tests/src/test/java/org/eclipse/edc/test/bom/BomSmokeTests.java
index 1b7b0462f..611d6f7a9 100644
--- a/e2e-tests/bom-tests/src/test/java/org/eclipse/edc/test/bom/BomSmokeTests.java
+++ b/e2e-tests/bom-tests/src/test/java/org/eclipse/edc/test/bom/BomSmokeTests.java
@@ -70,6 +70,8 @@ class IdentityHub extends SmokeTest {
                                 put("web.http.identity.path", "/api/identity");
                                 put("web.http.version.port", valueOf(getFreePort()));
                                 put("web.http.version.path", "/api/version");
+                                put("web.http.did.port", valueOf(getFreePort()));
+                                put("web.http.did.path", "/api/did");
                                 put("edc.sts.account.api.url", "https://sts.com/accounts");
                                 put("edc.sts.accounts.api.auth.header.value", "password");
                             }
diff --git a/e2e-tests/runtimes/identityhub-remote-sts/build.gradle.kts b/e2e-tests/runtimes/identityhub-remote-sts/build.gradle.kts
index 4ec9b3e14..816affb72 100644
--- a/e2e-tests/runtimes/identityhub-remote-sts/build.gradle.kts
+++ b/e2e-tests/runtimes/identityhub-remote-sts/build.gradle.kts
@@ -18,13 +18,13 @@ plugins {
 }
 
 dependencies {
-    runtimeOnly(project(":core:presentation-api"))
     runtimeOnly(project(":core:identity-hub-did"))
     runtimeOnly(project(":core:identity-hub-core"))
     runtimeOnly(project(":core:identity-hub-participants"))
     runtimeOnly(project(":core:identity-hub-keypairs"))
     runtimeOnly(project(":extensions:did:local-did-publisher"))
     runtimeOnly(project(":extensions:common:credential-watchdog"))
+    runtimeOnly(project(":extensions:protocols:dcp:presentation-api"))
     runtimeOnly(project(":extensions:sts:sts-account-provisioner"))
     runtimeOnly(project(":extensions:sts:sts-account-service-remote"))
     runtimeOnly(project(":extensions:api:identity-api:did-api"))
diff --git a/extensions/api/identity-api/api-configuration/src/main/java/org/eclipse/edc/identityhub/api/configuration/IdentityApiConfigurationExtension.java b/extensions/api/identity-api/api-configuration/src/main/java/org/eclipse/edc/identityhub/api/configuration/IdentityApiConfigurationExtension.java
index 050eddba0..93d8c510a 100644
--- a/extensions/api/identity-api/api-configuration/src/main/java/org/eclipse/edc/identityhub/api/configuration/IdentityApiConfigurationExtension.java
+++ b/extensions/api/identity-api/api-configuration/src/main/java/org/eclipse/edc/identityhub/api/configuration/IdentityApiConfigurationExtension.java
@@ -16,9 +16,9 @@
 
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import jakarta.ws.rs.core.SecurityContext;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Configuration;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
@@ -40,7 +40,7 @@
 import java.util.stream.Stream;
 
 import static org.eclipse.edc.identityhub.api.configuration.IdentityApiConfigurationExtension.NAME;
-import static org.eclipse.edc.identityhub.spi.IdentityHubApiContext.IDENTITY;
+import static org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext.IDENTITY;
 
 @Extension(value = NAME)
 public class IdentityApiConfigurationExtension implements ServiceExtension {
diff --git a/extensions/api/identity-api/api-configuration/src/main/resources/identity-api-version.json b/extensions/api/identity-api/api-configuration/src/main/resources/identity-api-version.json
index 3b16ba551..d4a4bbc69 100644
--- a/extensions/api/identity-api/api-configuration/src/main/resources/identity-api-version.json
+++ b/extensions/api/identity-api/api-configuration/src/main/resources/identity-api-version.json
@@ -2,7 +2,7 @@
   {
     "version": "1.0.0-alpha",
     "urlPath": "/v1alpha",
-    "lastUpdated": "2025-01-16T09:00:00Z",
+    "lastUpdated": "2025-01-16T12:00:00Z",
     "maturity": null
   }
 ]
diff --git a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/DidManagementApiExtension.java b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/DidManagementApiExtension.java
index 82b828b0e..32789c5de 100644
--- a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/DidManagementApiExtension.java
+++ b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/DidManagementApiExtension.java
@@ -14,12 +14,12 @@
 
 package org.eclipse.edc.identityhub.api.didmanagement;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
 import org.eclipse.edc.identityhub.api.didmanagement.v1.unstable.DidManagementApiController;
 import org.eclipse.edc.identityhub.api.didmanagement.v1.unstable.GetAllDidsApiController;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.spi.system.ServiceExtension;
diff --git a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApi.java b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApi.java
index fbe15aeff..8a56f9d45 100644
--- a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApi.java
+++ b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApi.java
@@ -41,7 +41,7 @@ public interface DidManagementApi {
 
     @Operation(description = "Publish an (existing) DID document. The DID is expected to exist in the database.",
             operationId = "publishDid",
-            parameters = { @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH) },
+            parameters = {@Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)},
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = DidRequestPayload.class), mediaType = "application/json")),
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID document was successfully published."),
@@ -55,7 +55,7 @@ public interface DidManagementApi {
 
     @Operation(description = "Un-Publish an (existing) DID document. The DID is expected to exist in the database.",
             operationId = "unpublishDid",
-            parameters = { @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH) },
+            parameters = {@Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)},
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = DidRequestPayload.class), mediaType = "application/json")),
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID document was successfully un-published."),
@@ -71,7 +71,7 @@ public interface DidManagementApi {
 
     @Operation(description = "Query for DID documents.",
             operationId = "queryDids",
-            parameters = { @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH) },
+            parameters = {@Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)},
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = QuerySpec.class), mediaType = "application/json")),
             responses = {
                     @ApiResponse(responseCode = "200", description = "The list of DID Documents.",
@@ -86,7 +86,7 @@ public interface DidManagementApi {
 
     @Operation(description = "Get state of a DID document",
             operationId = "getDidState",
-            parameters = { @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH) },
+            parameters = {@Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)},
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = DidRequestPayload.class), mediaType = "application/json")),
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID state was successfully obtained"),
@@ -103,7 +103,7 @@ public interface DidManagementApi {
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = Service.class), mediaType = "application/json")),
             parameters = {
                     @Parameter(name = "autoPublish", description = "Whether the DID should get republished after the removal. Defaults to false."),
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID document was successfully updated."),
@@ -122,7 +122,7 @@ public interface DidManagementApi {
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = Service.class), mediaType = "application/json")),
             parameters = {
                     @Parameter(name = "autoPublish", description = "Whether the DID should get republished after the removal. Defaults to false."),
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID document was successfully updated."),
@@ -141,7 +141,7 @@ public interface DidManagementApi {
             parameters = {
                     @Parameter(name = "serviceId", description = "The ID of the service that should get removed"),
                     @Parameter(name = "autoPublish", description = "Whether the DID should " + "get republished after the removal. Defaults to false."),
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The DID document was successfully updated."),
diff --git a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiController.java b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiController.java
index 3ac6db640..d160b3e97 100644
--- a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiController.java
+++ b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiController.java
@@ -26,22 +26,22 @@
 import jakarta.ws.rs.core.SecurityContext;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.ServiceResult;
 
 import java.util.Collection;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
-@Path(Versions.UNSTABLE + "/participants/{participantId}/dids")
+@Path(Versions.UNSTABLE + "/participants/{participantContextId}/dids")
 public class DidManagementApiController implements DidManagementApi {
 
     private final DidDocumentService documentService;
diff --git a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiController.java b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiController.java
index ab682ab3d..59f8d9634 100644
--- a/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiController.java
+++ b/extensions/api/identity-api/did-api/src/main/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiController.java
@@ -23,15 +23,15 @@
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.api.Versions;
 import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.web.spi.exception.InvalidRequestException;
 
 import java.util.Collection;
 
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
diff --git a/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiControllerTest.java b/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiControllerTest.java
index 7eceaf290..1a9bde097 100644
--- a/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiControllerTest.java
+++ b/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/DidManagementApiControllerTest.java
@@ -17,10 +17,10 @@
 import io.restassured.specification.RequestSpecification;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
 import org.eclipse.edc.junit.annotations.ApiTest;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
diff --git a/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiControllerTest.java b/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiControllerTest.java
index 8966fabe4..38fe03aac 100644
--- a/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiControllerTest.java
+++ b/extensions/api/identity-api/did-api/src/test/java/org/eclipse/edc/identityhub/api/didmanagement/v1/unstable/GetAllDidsApiControllerTest.java
@@ -15,8 +15,8 @@
 package org.eclipse.edc.identityhub.api.didmanagement.v1.unstable;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.api.Versions;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.spi.result.ServiceResult;
 import org.eclipse.edc.web.jersey.testfixtures.RestControllerTestBase;
 import org.junit.jupiter.api.Test;
diff --git a/extensions/api/identity-api/keypair-api/build.gradle.kts b/extensions/api/identity-api/keypair-api/build.gradle.kts
index 78316d4a3..f4f9c0c13 100644
--- a/extensions/api/identity-api/keypair-api/build.gradle.kts
+++ b/extensions/api/identity-api/keypair-api/build.gradle.kts
@@ -8,9 +8,8 @@ dependencies {
     api(libs.edc.spi.core)
     api(project(":spi:identity-hub-spi"))
     api(project(":spi:keypair-spi"))
-    api(project(":spi:identity-hub-store-spi"))
     implementation(project(":extensions:api:identity-api:api-configuration"))
-    implementation(project(":extensions:api:identity-api:validators"))
+    implementation(project(":extensions:api:identity-api:validators:keypair-validators"))
     implementation(libs.edc.spi.web)
     implementation(libs.edc.lib.util)
     implementation(libs.jakarta.rsApi)
diff --git a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/KeyPairResourceManagementApiExtension.java b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/KeyPairResourceManagementApiExtension.java
index 1c6d51328..8952b2682 100644
--- a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/KeyPairResourceManagementApiExtension.java
+++ b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/KeyPairResourceManagementApiExtension.java
@@ -16,12 +16,12 @@
 
 import org.eclipse.edc.identityhub.api.keypair.v1.unstable.GetAllKeyPairsApiController;
 import org.eclipse.edc.identityhub.api.keypair.v1.unstable.KeyPairResourceApiController;
-import org.eclipse.edc.identityhub.api.v1.validation.KeyDescriptorValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.api.keypair.validation.KeyDescriptorValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.spi.EdcException;
diff --git a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/GetAllKeyPairsApiController.java b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/GetAllKeyPairsApiController.java
index 4c4ad4c96..0dea8d7a1 100644
--- a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/GetAllKeyPairsApiController.java
+++ b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/GetAllKeyPairsApiController.java
@@ -30,7 +30,7 @@
 import java.util.Collection;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
diff --git a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApi.java b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApi.java
index 663734cda..7299d60ad 100644
--- a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApi.java
+++ b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApi.java
@@ -39,7 +39,7 @@ public interface KeyPairResourceApi {
     @Operation(description = "Finds a KeyPairResource by ID.",
             operationId = "getKeyPair",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The KeyPairResource.",
@@ -67,7 +67,7 @@ public interface KeyPairResourceApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    Collection<KeyPairResource> queryKeyPairByParticipantId(String participantId, SecurityContext securityContext);
+    Collection<KeyPairResource> queryKeyPairByParticipantId(String participantContextId, SecurityContext securityContext);
 
     @Operation(description = "Adds a new key pair to a ParticipantContext. Note that the key pair is either generated, or the private key is expected to be found in the vault.",
             operationId = "addKeyPair",
@@ -83,13 +83,13 @@ public interface KeyPairResourceApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    void addKeyPair(String participantId, KeyDescriptor keyDescriptor, boolean makeDefault, SecurityContext securityContext);
+    void addKeyPair(String participantContextId, KeyDescriptor keyDescriptor, boolean makeDefault, SecurityContext securityContext);
 
 
     @Operation(description = "Sets a KeyPairResource to the ACTIVE state. Will fail if the current state is anything other than ACTIVE or CREATED.",
             operationId = "activateKeyPair",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The KeyPairResource."),
@@ -108,7 +108,7 @@ public interface KeyPairResourceApi {
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = KeyDescriptor.class), mediaType = "application/json")),
             parameters = {
                     @Parameter(name = "duration", description = "Indicates for how long the public key of the rotated/retired key pair should still be available "),
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The KeyPairResource was successfully rotated and linked to the participant."),
@@ -125,7 +125,7 @@ public interface KeyPairResourceApi {
     @Operation(description = "Revokes (=removes) a particular key pair, identified by their ID and create a new successor key.",
             operationId = "revokeKeyPair",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = KeyDescriptor.class), mediaType = "application/json")),
             responses = {
diff --git a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiController.java b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiController.java
index 45f77a506..accd48c39 100644
--- a/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiController.java
+++ b/extensions/api/identity-api/keypair-api/src/main/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiController.java
@@ -25,8 +25,8 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.SecurityContext;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.KeyDescriptorValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.keypair.validation.KeyDescriptorValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
@@ -43,12 +43,12 @@
 import java.util.Collection;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 import static org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextId.onEncoded;
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
-@Path(Versions.UNSTABLE + "/participants/{participantId}/keypairs")
+@Path(Versions.UNSTABLE + "/participants/{participantContextId}/keypairs")
 public class KeyPairResourceApiController implements KeyPairResourceApi {
 
     private final AuthorizationService authorizationService;
@@ -80,18 +80,18 @@ public KeyPairResource getKeyPair(@PathParam("keyPairId") String id, @Context Se
 
     @GET
     @Override
-    public Collection<KeyPairResource> queryKeyPairByParticipantId(@PathParam("participantId") String participantId, @Context SecurityContext securityContext) {
-        return onEncoded(participantId).map(decoded -> {
-            var query = ParticipantResource.queryByParticipantId(decoded).build();
+    public Collection<KeyPairResource> queryKeyPairByParticipantId(@PathParam("participantContextId") String participantContextId, @Context SecurityContext securityContext) {
+        return onEncoded(participantContextId).map(decoded -> {
+            var query = ParticipantResource.queryByParticipantContextId(decoded).build();
             return keyPairService.query(query).orElseThrow(exceptionMapper(KeyPairResource.class, decoded)).stream().filter(kpr -> authorizationService.isAuthorized(securityContext, kpr.getId(), KeyPairResource.class).succeeded()).toList();
         }).orElseThrow(InvalidRequestException::new);
     }
 
     @PUT
     @Override
-    public void addKeyPair(@PathParam("participantId") String participantId, KeyDescriptor keyDescriptor, @QueryParam("makeDefault") boolean makeDefault, @Context SecurityContext securityContext) {
+    public void addKeyPair(@PathParam("participantContextId") String participantContextId, KeyDescriptor keyDescriptor, @QueryParam("makeDefault") boolean makeDefault, @Context SecurityContext securityContext) {
         keyDescriptorValidator.validate(keyDescriptor).orElseThrow(ValidationFailureException::new);
-        onEncoded(participantId)
+        onEncoded(participantContextId)
                 .onSuccess(decoded ->
                         authorizationService.isAuthorized(securityContext, decoded, ParticipantContext.class)
                                 .compose(u -> keyPairService.addKeyPair(decoded, keyDescriptor, makeDefault))
diff --git a/extensions/api/identity-api/keypair-api/src/test/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiControllerTest.java b/extensions/api/identity-api/keypair-api/src/test/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiControllerTest.java
index b00f71d72..87e5b8c52 100644
--- a/extensions/api/identity-api/keypair-api/src/test/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiControllerTest.java
+++ b/extensions/api/identity-api/keypair-api/src/test/java/org/eclipse/edc/identityhub/api/keypair/v1/unstable/KeyPairResourceApiControllerTest.java
@@ -17,8 +17,8 @@
 import io.restassured.http.ContentType;
 import io.restassured.specification.RequestSpecification;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.KeyDescriptorValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.keypair.validation.KeyDescriptorValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
@@ -113,7 +113,7 @@ void findForParticipant() {
 
         verify(keyPairService).query(argThat(q -> {
             var criterion = q.getFilterExpression().get(0);
-            return criterion.getOperandLeft().equals("participantId") &&
+            return criterion.getOperandLeft().equals("participantContextId") &&
                     criterion.getOperator().equals("=") &&
                     criterion.getOperandRight().equals(PARTICIPANT_ID);
         }));
@@ -135,7 +135,7 @@ void findForParticipant_noResult() {
 
         verify(keyPairService).query(argThat(q -> {
             var criterion = q.getFilterExpression().get(0);
-            return criterion.getOperandLeft().equals("participantId") &&
+            return criterion.getOperandLeft().equals("participantContextId") &&
                     criterion.getOperator().equals("=") &&
                     criterion.getOperandRight().equals(PARTICIPANT_ID);
         }));
@@ -153,14 +153,14 @@ void findForParticipant_notfound() {
 
         verify(keyPairService).query(argThat(q -> {
             var criterion = q.getFilterExpression().get(0);
-            return criterion.getOperandLeft().equals("participantId") &&
+            return criterion.getOperandLeft().equals("participantContextId") &&
                     criterion.getOperator().equals("=") &&
                     criterion.getOperandRight().equals(PARTICIPANT_ID);
         }));
     }
 
     @ParameterizedTest(name = "Make default: {0}")
-    @ValueSource(booleans = { true, false })
+    @ValueSource(booleans = {true, false})
     void addKeyPair(boolean makeDefault) {
         var descriptor = createKeyDescriptor()
                 .build();
@@ -354,7 +354,7 @@ protected Object controller() {
     private KeyPairResource.Builder createKeyPair() {
         return KeyPairResource.Builder.newInstance()
                 .id("test-keypair")
-                .participantId(PARTICIPANT_ID)
+                .participantContextId(PARTICIPANT_ID)
                 .isDefaultPair(true)
                 .privateKeyAlias("test-alias")
                 .useDuration(Duration.ofDays(365).toMillis());
diff --git a/extensions/api/identity-api/participant-context-api/build.gradle.kts b/extensions/api/identity-api/participant-context-api/build.gradle.kts
index 0acf98019..57229f794 100644
--- a/extensions/api/identity-api/participant-context-api/build.gradle.kts
+++ b/extensions/api/identity-api/participant-context-api/build.gradle.kts
@@ -23,7 +23,7 @@ dependencies {
     api(project(":spi:identity-hub-spi"))
     api(project(":spi:did-spi"))
     implementation(project(":extensions:api:identity-api:api-configuration"))
-    implementation(project(":extensions:api:identity-api:validators"))
+    implementation(project(":extensions:api:identity-api:validators:participant-context-validators"))
     implementation(libs.edc.spi.validator)
     implementation(libs.edc.spi.web)
     implementation(libs.edc.lib.util)
diff --git a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/ParticipantContextManagementApiExtension.java b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ParticipantContextManagementApiExtension.java
similarity index 74%
rename from extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/ParticipantContextManagementApiExtension.java
rename to extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ParticipantContextManagementApiExtension.java
index 4ed9d4283..b1cfadc9c 100644
--- a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/ParticipantContextManagementApiExtension.java
+++ b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ParticipantContextManagementApiExtension.java
@@ -12,14 +12,14 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext;
+package org.eclipse.edc.identityhub.api.verifiablecredential;
 
-import org.eclipse.edc.identityhub.api.participantcontext.v1.unstable.ParticipantContextApiController;
-import org.eclipse.edc.identityhub.api.v1.validation.ParticipantManifestValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable.ParticipantContextApiController;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.ParticipantManifestValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.spi.monitor.Monitor;
@@ -27,8 +27,8 @@
 import org.eclipse.edc.spi.system.ServiceExtensionContext;
 import org.eclipse.edc.web.spi.WebService;
 
-import static org.eclipse.edc.identityhub.api.participantcontext.ParticipantContextManagementApiExtension.NAME;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.api.verifiablecredential.ParticipantContextManagementApiExtension.NAME;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 
 @Extension(value = NAME)
 public class ParticipantContextManagementApiExtension implements ServiceExtension {
diff --git a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApi.java b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApi.java
similarity index 92%
rename from extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApi.java
rename to extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApi.java
index 3601af233..a483c50b7 100644
--- a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApi.java
+++ b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApi.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext.v1.unstable;
+package org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable;
 
 import io.swagger.v3.oas.annotations.OpenAPIDefinition;
 import io.swagger.v3.oas.annotations.Operation;
@@ -68,13 +68,13 @@ public interface ParticipantContextApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    ParticipantContext getParticipant(String participantId, SecurityContext securityContext);
+    ParticipantContext getParticipant(String participantContextId, SecurityContext securityContext);
 
     @Operation(description = "Regenerates the API token for a ParticipantContext and returns the new token.",
             operationId = "regenerateParticipantToken",
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = ParticipantManifest.class), mediaType = "application/json")),
             responses = {
-                    @ApiResponse(responseCode = "200", description = "The API token was regenerated successfully", content = { @Content(schema = @Schema(implementation = String.class)) }),
+                    @ApiResponse(responseCode = "200", description = "The API token was regenerated successfully", content = {@Content(schema = @Schema(implementation = String.class))}),
                     @ApiResponse(responseCode = "400", description = "Request body was malformed, or the request could not be processed",
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json")),
                     @ApiResponse(responseCode = "401", description = "The request could not be completed, because either the authentication was missing or was not valid.",
@@ -83,14 +83,14 @@ public interface ParticipantContextApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    String regenerateParticipantToken(String participantId, SecurityContext securityContext);
+    String regenerateParticipantToken(String participantContextId, SecurityContext securityContext);
 
     @Operation(description = "Activates a ParticipantContext. This operation is idempotent, i.e. activating an already active ParticipantContext is a NOOP.",
             operationId = "activateParticipant",
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = ParticipantManifest.class), mediaType = "application/json")),
-            parameters = { @Parameter(name = "isActive", description = "Whether the participantContext should be activated or deactivated. Defaults to 'false'") },
+            parameters = {@Parameter(name = "isActive", description = "Whether the participantContext should be activated or deactivated. Defaults to 'false'")},
             responses = {
-                    @ApiResponse(responseCode = "200", description = "The ParticipantContext was activated/deactivated successfully", content = { @Content(schema = @Schema(implementation = String.class)) }),
+                    @ApiResponse(responseCode = "200", description = "The ParticipantContext was activated/deactivated successfully", content = {@Content(schema = @Schema(implementation = String.class))}),
                     @ApiResponse(responseCode = "400", description = "Request body was malformed, or the request could not be processed",
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json")),
                     @ApiResponse(responseCode = "401", description = "The request could not be completed, because either the authentication was missing or was not valid.",
@@ -99,12 +99,12 @@ public interface ParticipantContextApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    void activateParticipant(String participantId, boolean isActive);
+    void activateParticipant(String participantContextId, boolean isActive);
 
     @Operation(description = "Delete a ParticipantContext.",
             operationId = "deleteParticipant",
             responses = {
-                    @ApiResponse(responseCode = "200", description = "The ParticipantContext was deleted successfully", content = { @Content(schema = @Schema(implementation = String.class)) }),
+                    @ApiResponse(responseCode = "200", description = "The ParticipantContext was deleted successfully", content = {@Content(schema = @Schema(implementation = String.class))}),
                     @ApiResponse(responseCode = "400", description = "Request body was malformed, or the request could not be processed",
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json")),
                     @ApiResponse(responseCode = "401", description = "The request could not be completed, because either the authentication was missing or was not valid.",
@@ -113,7 +113,7 @@ public interface ParticipantContextApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    void deleteParticipant(String participantId, SecurityContext securityContext);
+    void deleteParticipant(String participantContextId, SecurityContext securityContext);
 
     @Operation(description = "Updates a ParticipantContext's roles. Note that this is an absolute update, that means all roles that the Participant should have must be submitted in the body. Requires elevated privileges.",
             operationId = "updateParticipantRoles",
@@ -128,13 +128,13 @@ public interface ParticipantContextApi {
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json"))
             }
     )
-    void updateParticipantRoles(String participantId, List<String> roles);
+    void updateParticipantRoles(String participantContextId, List<String> roles);
 
     @Operation(description = "Get all DID documents across all Participant Contexts. Requires elevated access.",
             operationId = "getAllParticipants",
             parameters = {
                     @Parameter(name = "offset", description = "the paging offset. defaults to 0"),
-                    @Parameter(name = "limit", description = "the page size. defaults to 50") },
+                    @Parameter(name = "limit", description = "the page size. defaults to 50")},
             responses = {
                     @ApiResponse(responseCode = "200", description = "The list of ParticipantContexts.",
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ParticipantContext.class)))),
diff --git a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiController.java b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiController.java
similarity index 79%
rename from extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiController.java
rename to extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiController.java
index 7c4b76ec1..276b872e9 100644
--- a/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiController.java
+++ b/extensions/api/identity-api/participant-context-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiController.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext.v1.unstable;
+package org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable;
 
 import jakarta.annotation.security.RolesAllowed;
 import jakarta.ws.rs.Consumes;
@@ -28,9 +28,9 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.SecurityContext;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.ParticipantManifestValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.ParticipantManifestValidator;
 import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.CreateParticipantContextResponse;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
@@ -43,7 +43,7 @@
 import java.util.List;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 import static org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextId.onEncoded;
 
 @Consumes(APPLICATION_JSON)
@@ -72,9 +72,9 @@ public CreateParticipantContextResponse createParticipant(ParticipantManifest ma
 
     @Override
     @GET
-    @Path("/{participantId}")
-    public ParticipantContext getParticipant(@PathParam("participantId") String participantId, @Context SecurityContext securityContext) {
-        return onEncoded(participantId)
+    @Path("/{participantContextId}")
+    public ParticipantContext getParticipant(@PathParam("participantContextId") String participantContextId, @Context SecurityContext securityContext) {
+        return onEncoded(participantContextId)
                 .map(decoded -> authorizationService.isAuthorized(securityContext, decoded, ParticipantContext.class)
                         .compose(u -> participantContextService.getParticipantContext(decoded))
                         .orElseThrow(exceptionMapper(ParticipantContext.class, decoded)))
@@ -83,9 +83,9 @@ public ParticipantContext getParticipant(@PathParam("participantId") String part
 
     @Override
     @POST
-    @Path("/{participantId}/token")
-    public String regenerateParticipantToken(@PathParam("participantId") String participantId, @Context SecurityContext securityContext) {
-        return onEncoded(participantId)
+    @Path("/{participantContextId}/token")
+    public String regenerateParticipantToken(@PathParam("participantContextId") String participantContextId, @Context SecurityContext securityContext) {
+        return onEncoded(participantContextId)
                 .map(decoded -> authorizationService.isAuthorized(securityContext, decoded, ParticipantContext.class)
                         .compose(u -> participantContextService.regenerateApiToken(decoded))
                         .orElseThrow(exceptionMapper(ParticipantContext.class, decoded)))
@@ -94,10 +94,10 @@ public String regenerateParticipantToken(@PathParam("participantId") String part
 
     @Override
     @POST
-    @Path("/{participantId}/state")
+    @Path("/{participantContextId}/state")
     @RolesAllowed(ServicePrincipal.ROLE_ADMIN)
-    public void activateParticipant(@PathParam("participantId") String participantId, @QueryParam("isActive") boolean isActive) {
-        onEncoded(participantId)
+    public void activateParticipant(@PathParam("participantContextId") String participantContextId, @QueryParam("isActive") boolean isActive) {
+        onEncoded(participantContextId)
                 .onSuccess(decoded -> participantContextService.updateParticipant(decoded, isActive ? ParticipantContext::activate : ParticipantContext::deactivate)
                         .orElseThrow(exceptionMapper(ParticipantContext.class, decoded)))
                 .orElseThrow(InvalidRequestException::new);
@@ -105,10 +105,10 @@ public void activateParticipant(@PathParam("participantId") String participantId
 
     @Override
     @DELETE
-    @Path("/{participantId}")
+    @Path("/{participantContextId}")
     @RolesAllowed(ServicePrincipal.ROLE_ADMIN)
-    public void deleteParticipant(@PathParam("participantId") String participantId, @Context SecurityContext securityContext) {
-        onEncoded(participantId)
+    public void deleteParticipant(@PathParam("participantContextId") String participantContextId, @Context SecurityContext securityContext) {
+        onEncoded(participantContextId)
                 .onSuccess(decoded -> participantContextService.deleteParticipantContext(decoded)
                         .orElseThrow(exceptionMapper(ParticipantContext.class, decoded)))
                 .orElseThrow(InvalidRequestException::new);
@@ -116,10 +116,10 @@ public void deleteParticipant(@PathParam("participantId") String participantId,
 
     @Override
     @PUT
-    @Path("/{participantId}/roles")
+    @Path("/{participantContextId}/roles")
     @RolesAllowed(ServicePrincipal.ROLE_ADMIN)
-    public void updateParticipantRoles(@PathParam("participantId") String participantId, List<String> roles) {
-        onEncoded(participantId)
+    public void updateParticipantRoles(@PathParam("participantContextId") String participantContextId, List<String> roles) {
+        onEncoded(participantContextId)
                 .onSuccess(decoded -> participantContextService.updateParticipant(decoded, participantContext -> participantContext.setRoles(roles))
                         .orElseThrow(exceptionMapper(ParticipantContext.class, decoded)))
                 .orElseThrow(InvalidRequestException::new);
diff --git a/extensions/api/identity-api/participant-context-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension b/extensions/api/identity-api/participant-context-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
index 926468c8e..5a7beeab2 100644
--- a/extensions/api/identity-api/participant-context-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
+++ b/extensions/api/identity-api/participant-context-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
@@ -12,4 +12,4 @@
 #
 #
 
-org.eclipse.edc.identityhub.api.participantcontext.ParticipantContextManagementApiExtension
+org.eclipse.edc.identityhub.api.verifiablecredential.ParticipantContextManagementApiExtension
diff --git a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiControllerTest.java b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiControllerTest.java
similarity index 96%
rename from extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiControllerTest.java
rename to extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiControllerTest.java
index 5de18ba7e..6e3cfe8be 100644
--- a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/ParticipantContextApiControllerTest.java
+++ b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/ParticipantContextApiControllerTest.java
@@ -12,15 +12,15 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext.v1.unstable;
+package org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.jwk.Curve;
 import com.nimbusds.jose.jwk.gen.OctetKeyPairGenerator;
 import io.restassured.specification.RequestSpecification;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.ParticipantManifestValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.ParticipantManifestValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.CreateParticipantContextResponse;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
@@ -78,7 +78,7 @@ void getById() {
         when(participantContextServiceMock.getParticipantContext(any())).thenReturn(ServiceResult.success(pc));
 
         var participantContext = baseRequest()
-                .get("/%s".formatted(pc.getParticipantId()))
+                .get("/%s".formatted(pc.getParticipantContextId()))
                 .then()
                 .statusCode(200)
                 .log().ifError()
@@ -99,80 +99,6 @@ void getById_whenNotFound() {
                 .log().ifError();
     }
 
-    @Nested
-    class Create {
-        @Test
-        void shouldReturnOk_whenParticipantIsCreated() {
-            var response = new CreateParticipantContextResponse("apiKey", "clientId", "clientSecret");
-            when(participantContextServiceMock.createParticipantContext(any())).thenReturn(ServiceResult.success(response));
-            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.success());
-            var manifest = createManifest().build();
-
-            baseRequest()
-                    .accept(JSON)
-                    .contentType(JSON)
-                    .body(manifest)
-                    .post()
-                    .then()
-                    .statusCode(200)
-                    .contentType(JSON)
-                    .body("apiKey", is("apiKey"))
-                    .body("clientId", is("clientId"))
-                    .body("clientSecret", is("clientSecret"));
-            verify(participantContextServiceMock).createParticipantContext(any(ParticipantManifest.class));
-        }
-
-        @Test
-        void shouldReturnBadRequest_whenValidationFails() {
-            var manifest = createManifest()
-                    .participantId(null)
-                    .build();
-            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.failure(emptyList()));
-
-            baseRequest()
-                    .contentType(JSON)
-                    .body(manifest)
-                    .post()
-                    .then()
-                    .statusCode(400);
-
-            verifyNoInteractions(participantContextServiceMock);
-        }
-
-        @Test
-        void shouldReturnBadRequest_whenInvalidKeyDescriptor() {
-            var manifest = createManifest()
-                    .key(createKey().publicKeyPem(null).publicKeyJwk(null).keyGeneratorParams(null).build())
-                    .build();
-            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.failure(emptyList()));
-
-            baseRequest()
-                    .contentType(JSON)
-                    .body(manifest)
-                    .post()
-                    .then()
-                    .statusCode(400);
-
-            verifyNoInteractions(participantContextServiceMock);
-        }
-
-        @Test
-        void shouldReturnConflict_whenAlreadyExists() {
-            when(participantContextServiceMock.createParticipantContext(any())).thenReturn(ServiceResult.conflict("already exists"));
-            var manifest = createManifest().build();
-            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.success());
-
-            baseRequest()
-                    .contentType(JSON)
-                    .body(manifest)
-                    .post()
-                    .then()
-                    .statusCode(409);
-
-            verify(participantContextServiceMock).createParticipantContext(any(ParticipantManifest.class));
-        }
-    }
-
     @Test
     void regenerateToken() {
         when(participantContextServiceMock.regenerateApiToken(any())).thenReturn(ServiceResult.success("new-api-token"));
@@ -268,7 +194,7 @@ void updateRoles_notFound() {
 
     @Test
     void getAll() {
-        var list = IntStream.range(0, 10).mapToObj(i -> createParticipantContext().participantId("participant" + i).build()).toList();
+        var list = IntStream.range(0, 10).mapToObj(i -> createParticipantContext().participantContextId("participant" + i).build()).toList();
         when(participantContextServiceMock.query(any())).thenReturn(ServiceResult.success(list));
 
         var participantContexts = baseRequest()
@@ -290,7 +216,7 @@ protected Object controller() {
 
     private ParticipantContext.Builder createParticipantContext() {
         return ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .createdAt(Instant.now().toEpochMilli())
                 .state(ParticipantContextState.ACTIVATED)
                 .apiTokenAlias("test-alias");
@@ -327,4 +253,78 @@ private Map<String, Object> createJwk() {
             throw new RuntimeException(e);
         }
     }
+
+    @Nested
+    class Create {
+        @Test
+        void shouldReturnOk_whenParticipantIsCreated() {
+            var response = new CreateParticipantContextResponse("apiKey", "clientId", "clientSecret");
+            when(participantContextServiceMock.createParticipantContext(any())).thenReturn(ServiceResult.success(response));
+            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.success());
+            var manifest = createManifest().build();
+
+            baseRequest()
+                    .accept(JSON)
+                    .contentType(JSON)
+                    .body(manifest)
+                    .post()
+                    .then()
+                    .statusCode(200)
+                    .contentType(JSON)
+                    .body("apiKey", is("apiKey"))
+                    .body("clientId", is("clientId"))
+                    .body("clientSecret", is("clientSecret"));
+            verify(participantContextServiceMock).createParticipantContext(any(ParticipantManifest.class));
+        }
+
+        @Test
+        void shouldReturnBadRequest_whenValidationFails() {
+            var manifest = createManifest()
+                    .participantId(null)
+                    .build();
+            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.failure(emptyList()));
+
+            baseRequest()
+                    .contentType(JSON)
+                    .body(manifest)
+                    .post()
+                    .then()
+                    .statusCode(400);
+
+            verifyNoInteractions(participantContextServiceMock);
+        }
+
+        @Test
+        void shouldReturnBadRequest_whenInvalidKeyDescriptor() {
+            var manifest = createManifest()
+                    .key(createKey().publicKeyPem(null).publicKeyJwk(null).keyGeneratorParams(null).build())
+                    .build();
+            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.failure(emptyList()));
+
+            baseRequest()
+                    .contentType(JSON)
+                    .body(manifest)
+                    .post()
+                    .then()
+                    .statusCode(400);
+
+            verifyNoInteractions(participantContextServiceMock);
+        }
+
+        @Test
+        void shouldReturnConflict_whenAlreadyExists() {
+            when(participantContextServiceMock.createParticipantContext(any())).thenReturn(ServiceResult.conflict("already exists"));
+            var manifest = createManifest().build();
+            when(participantManifestValidator.validate(any())).thenReturn(ValidationResult.success());
+
+            baseRequest()
+                    .contentType(JSON)
+                    .body(manifest)
+                    .post()
+                    .then()
+                    .statusCode(409);
+
+            verify(participantContextServiceMock).createParticipantContext(any(ParticipantManifest.class));
+        }
+    }
 }
diff --git a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/KeyDescriptorTest.java b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/KeyDescriptorTest.java
similarity index 94%
rename from extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/KeyDescriptorTest.java
rename to extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/KeyDescriptorTest.java
index 2d6c8ef38..df95b8346 100644
--- a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/KeyDescriptorTest.java
+++ b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/KeyDescriptorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext.v1.unstable.model;
+package org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable.model;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
diff --git a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/ParticipantManifestTest.java b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/ParticipantManifestTest.java
similarity index 95%
rename from extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/ParticipantManifestTest.java
rename to extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/ParticipantManifestTest.java
index 177eebaf3..c09eb8b29 100644
--- a/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/participantcontext/v1/unstable/model/ParticipantManifestTest.java
+++ b/extensions/api/identity-api/participant-context-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/v1/unstable/model/ParticipantManifestTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.participantcontext.v1.unstable.model;
+package org.eclipse.edc.identityhub.api.verifiablecredential.v1.unstable.model;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
diff --git a/extensions/api/identity-api/validators/build.gradle.kts b/extensions/api/identity-api/validators/keypair-validators/build.gradle.kts
similarity index 100%
rename from extensions/api/identity-api/validators/build.gradle.kts
rename to extensions/api/identity-api/validators/keypair-validators/build.gradle.kts
diff --git a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidator.java b/extensions/api/identity-api/validators/keypair-validators/src/main/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidator.java
similarity index 98%
rename from extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidator.java
rename to extensions/api/identity-api/validators/keypair-validators/src/main/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidator.java
index 0c346a8a1..5b9b4dc9b 100644
--- a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidator.java
+++ b/extensions/api/identity-api/validators/keypair-validators/src/main/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidator.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.keypair.validation;
 
 import org.eclipse.edc.iam.did.spi.document.DidConstants;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
diff --git a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidatorTest.java b/extensions/api/identity-api/validators/keypair-validators/src/test/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidatorTest.java
similarity index 98%
rename from extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidatorTest.java
rename to extensions/api/identity-api/validators/keypair-validators/src/test/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidatorTest.java
index 0305803ac..552e87f2f 100644
--- a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/KeyDescriptorValidatorTest.java
+++ b/extensions/api/identity-api/validators/keypair-validators/src/test/java/org/eclipse/edc/identityhub/api/keypair/validation/KeyDescriptorValidatorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.keypair.validation;
 
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
 import org.eclipse.edc.spi.monitor.ConsoleMonitor;
diff --git a/extensions/api/identity-api/validators/participant-context-validators/build.gradle.kts b/extensions/api/identity-api/validators/participant-context-validators/build.gradle.kts
new file mode 100644
index 000000000..1118a9e4d
--- /dev/null
+++ b/extensions/api/identity-api/validators/participant-context-validators/build.gradle.kts
@@ -0,0 +1,15 @@
+plugins {
+    `java-library`
+    `maven-publish`
+}
+
+dependencies {
+    api(libs.edc.spi.core)
+    api(project(":spi:identity-hub-spi"))
+    api(project(":spi:did-spi"))
+    api(project(":spi:verifiable-credential-spi"))
+    implementation(project(":extensions:api:identity-api:validators:keypair-validators"))
+    implementation(libs.edc.lib.util)
+
+    testImplementation(libs.edc.junit)
+}
diff --git a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidator.java b/extensions/api/identity-api/validators/participant-context-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidator.java
similarity index 93%
rename from extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidator.java
rename to extensions/api/identity-api/validators/participant-context-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidator.java
index 628026032..0721e2855 100644
--- a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidator.java
+++ b/extensions/api/identity-api/validators/participant-context-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidator.java
@@ -12,8 +12,9 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.verifiablecredential.validation;
 
+import org.eclipse.edc.identityhub.api.keypair.validation.KeyDescriptorValidator;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantManifest;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.util.string.StringUtils;
diff --git a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidatorTest.java b/extensions/api/identity-api/validators/participant-context-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidatorTest.java
similarity index 95%
rename from extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidatorTest.java
rename to extensions/api/identity-api/validators/participant-context-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidatorTest.java
index 39b76e066..520855ea0 100644
--- a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/ParticipantManifestValidatorTest.java
+++ b/extensions/api/identity-api/validators/participant-context-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/ParticipantManifestValidatorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.verifiablecredential.validation;
 
 import org.eclipse.edc.iam.did.spi.document.Service;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.KeyDescriptor;
@@ -78,7 +78,7 @@ void validate_keyDescriptorInvalid() {
     }
 
     @ParameterizedTest
-    @ValueSource(strings = { "", "  ", "\n" })
+    @ValueSource(strings = {"", "  ", "\n"})
     @NullAndEmptySource
     void validate_didInvalid(String did) {
         var manifest = createManifest().did(did).build();
@@ -87,7 +87,7 @@ void validate_didInvalid(String did) {
     }
 
     @ParameterizedTest
-    @ValueSource(strings = { "", "  ", "\n" })
+    @ValueSource(strings = {"", "  ", "\n"})
     @NullAndEmptySource
     void validate_participantIdNull(String participantId) {
         var manifest = createManifest().participantId(participantId).build();
diff --git a/extensions/api/identity-api/validators/verifiable-credential-validators/build.gradle.kts b/extensions/api/identity-api/validators/verifiable-credential-validators/build.gradle.kts
new file mode 100644
index 000000000..42639e04b
--- /dev/null
+++ b/extensions/api/identity-api/validators/verifiable-credential-validators/build.gradle.kts
@@ -0,0 +1,14 @@
+plugins {
+    `java-library`
+    `maven-publish`
+}
+
+dependencies {
+    api(libs.edc.spi.core)
+    api(project(":spi:identity-hub-spi"))
+    api(project(":spi:did-spi"))
+    api(project(":spi:verifiable-credential-spi"))
+    implementation(libs.edc.lib.util)
+
+    testImplementation(libs.edc.junit)
+}
diff --git a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidator.java b/extensions/api/identity-api/validators/verifiable-credential-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidator.java
similarity index 86%
rename from extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidator.java
rename to extensions/api/identity-api/validators/verifiable-credential-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidator.java
index d56ddced9..975aa7856 100644
--- a/extensions/api/identity-api/validators/src/main/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidator.java
+++ b/extensions/api/identity-api/validators/verifiable-credential-validators/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidator.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.verifiablecredential.validation;
 
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialManifest;
 import org.eclipse.edc.validator.spi.ValidationResult;
@@ -29,8 +29,8 @@ public ValidationResult validate(VerifiableCredentialManifest input) {
             return failure(violation("Input was null", "."));
         }
 
-        if (input.getParticipantId() == null) {
-            return failure(violation("Participant id was null", "participantId"));
+        if (input.getParticipantContextId() == null) {
+            return failure(violation("participantContextId id was null", "participantContextId"));
         }
 
         var container = input.getVerifiableCredentialContainer();
diff --git a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidatorTest.java b/extensions/api/identity-api/validators/verifiable-credential-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidatorTest.java
similarity index 92%
rename from extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidatorTest.java
rename to extensions/api/identity-api/validators/verifiable-credential-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidatorTest.java
index a3131b3af..8a33604fa 100644
--- a/extensions/api/identity-api/validators/src/test/java/org/eclipse/edc/identityhub/api/v1/validation/VerifiableCredentialManifestValidatorTest.java
+++ b/extensions/api/identity-api/validators/verifiable-credential-validators/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredential/validation/VerifiableCredentialManifestValidatorTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1.validation;
+package org.eclipse.edc.identityhub.api.verifiablecredential.validation;
 
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialSubject;
@@ -35,7 +35,7 @@ class VerifiableCredentialManifestValidatorTest {
     void validManifest_shouldPassValidation() {
         var manifest = VerifiableCredentialManifest.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
-                .participantId(UUID.randomUUID().toString())
+                .participantContextId(UUID.randomUUID().toString())
                 .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, VerifiableCredential.Builder.newInstance()
                         .type("type")
                         .credentialSubject(CredentialSubject.Builder.newInstance()
@@ -56,7 +56,7 @@ void validManifest_shouldPassValidation() {
     void validate_missingVerifiableCredentialContainer_shouldFailValidation() {
         var manifest = VerifiableCredentialManifest.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
-                .participantId(UUID.randomUUID().toString())
+                .participantContextId(UUID.randomUUID().toString())
                 .build();
 
         var result = validator.validate(manifest);
@@ -79,7 +79,7 @@ void validate_missingParticipantId_shouldFailValidation() {
     void validate_missingVerifiableCredential_shouldFailValidation() {
         var manifest = VerifiableCredentialManifest.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
-                .participantId(UUID.randomUUID().toString())
+                .participantContextId(UUID.randomUUID().toString())
                 .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, null))
                 .build();
 
diff --git a/extensions/api/identity-api/verifiable-credentials-api/build.gradle.kts b/extensions/api/identity-api/verifiable-credentials-api/build.gradle.kts
index 389180b30..b9b5b75e1 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/build.gradle.kts
+++ b/extensions/api/identity-api/verifiable-credentials-api/build.gradle.kts
@@ -7,10 +7,9 @@ plugins {
 dependencies {
     api(libs.edc.spi.core)
     api(project(":spi:identity-hub-spi"))
-    api(project(":spi:identity-hub-store-spi"))
     api(project(":spi:verifiable-credential-spi"))
     implementation(project(":extensions:api:identity-api:api-configuration"))
-    implementation(project(":extensions:api:identity-api:validators"))
+    implementation(project(":extensions:api:identity-api:validators:verifiable-credential-validators"))
     implementation(libs.edc.spi.transform)
     implementation(libs.edc.spi.web)
     implementation(libs.edc.lib.util)
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/VerifiableCredentialApiExtension.java b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/VerifiableCredentialApiExtension.java
index 1c3ef140b..526f093ca 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/VerifiableCredentialApiExtension.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/VerifiableCredentialApiExtension.java
@@ -14,15 +14,15 @@
 
 package org.eclipse.edc.identityhub.api.verifiablecredentials;
 
-import org.eclipse.edc.identityhub.api.v1.validation.VerifiableCredentialManifestValidator;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.VerifiableCredentialManifestValidator;
 import org.eclipse.edc.identityhub.api.verifiablecredentials.v1.unstable.GetAllCredentialsApiController;
 import org.eclipse.edc.identityhub.api.verifiablecredentials.v1.unstable.VerifiableCredentialsApiController;
 import org.eclipse.edc.identityhub.api.verifiablecredentials.v1.unstable.transformer.VerifiableCredentialManifestToVerifiableCredentialResourceTransformer;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.spi.EdcException;
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/GetAllCredentialsApiController.java b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/GetAllCredentialsApiController.java
index ba1b0a4b6..d8bed78a7 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/GetAllCredentialsApiController.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/GetAllCredentialsApiController.java
@@ -23,15 +23,15 @@
 import jakarta.ws.rs.QueryParam;
 import org.eclipse.edc.identityhub.api.Versions;
 import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.ServiceResult;
 
 import java.util.Collection;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApi.java b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApi.java
index c0907b3f5..ec13e52a4 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApi.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApi.java
@@ -40,7 +40,7 @@ public interface VerifiableCredentialsApi {
     @Operation(description = "Finds a VerifiableCredential by ID.",
             operationId = "getCredential",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
             },
             responses = {
                     @ApiResponse(responseCode = "200", description = "The VerifiableCredential.",
@@ -58,7 +58,7 @@ public interface VerifiableCredentialsApi {
     @Operation(description = "Adds a new VerifiableCredential into the system.",
             operationId = "addCredential",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = VerifiableCredentialManifest.class))),
             responses = {
@@ -76,7 +76,7 @@ public interface VerifiableCredentialsApi {
     @Operation(description = "Update an existing VerifiableCredential.",
             operationId = "updateCredential",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH)
             },
             requestBody = @RequestBody(content = @Content(schema = @Schema(implementation = VerifiableCredentialManifest.class))),
             responses = {
@@ -95,7 +95,7 @@ public interface VerifiableCredentialsApi {
     @Operation(description = "Query VerifiableCredentials by type.",
             operationId = "queryCredentialsByType",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
                     @Parameter(name = "type", description = "Credential type. If omitted, all credentials are returned (limited to 50 elements).")
             },
             responses = {
@@ -112,10 +112,10 @@ public interface VerifiableCredentialsApi {
     @Operation(description = "Delete a VerifiableCredential.",
             operationId = "deleteCredential",
             parameters = {
-                    @Parameter(name = "participantId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
+                    @Parameter(name = "participantContextId", description = "Base64-Url encode Participant Context ID", required = true, in = ParameterIn.PATH),
             },
             responses = {
-                    @ApiResponse(responseCode = "200", description = "The VerifiableCredential was deleted successfully", content = { @Content(schema = @Schema(implementation = String.class)) }),
+                    @ApiResponse(responseCode = "200", description = "The VerifiableCredential was deleted successfully", content = {@Content(schema = @Schema(implementation = String.class))}),
                     @ApiResponse(responseCode = "400", description = "Request body was malformed, or the request could not be processed",
                             content = @Content(array = @ArraySchema(schema = @Schema(implementation = ApiErrorDetail.class)), mediaType = "application/json")),
                     @ApiResponse(responseCode = "403", description = "The request could not be completed, because either the authentication was missing or was not valid.",
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiController.java b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiController.java
index 7d5f383f3..89ead7e11 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiController.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiController.java
@@ -27,12 +27,12 @@
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.SecurityContext;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.VerifiableCredentialManifestValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.VerifiableCredentialManifestValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialManifest;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.ServiceResult;
@@ -46,13 +46,13 @@
 import java.util.Collection;
 
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
-import static org.eclipse.edc.identityhub.spi.AuthorizationResultHandler.exceptionMapper;
+import static org.eclipse.edc.identityhub.spi.authorization.AuthorizationResultHandler.exceptionMapper;
 import static org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextId.onEncoded;
 import static org.eclipse.edc.spi.result.ServiceResult.badRequest;
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
-@Path(Versions.UNSTABLE + "/participants/{participantId}/credentials")
+@Path(Versions.UNSTABLE + "/participants/{participantContextId}/credentials")
 public class VerifiableCredentialsApiController implements VerifiableCredentialsApi {
 
     private final CredentialStore credentialStore;
@@ -81,7 +81,7 @@ public VerifiableCredentialResource getCredential(@PathParam("credentialId") Str
 
     @POST
     @Override
-    public void addCredential(@PathParam("participantId") String participantId, VerifiableCredentialManifest manifest, @Context SecurityContext securityContext) {
+    public void addCredential(@PathParam("participantContextId") String participantId, VerifiableCredentialManifest manifest, @Context SecurityContext securityContext) {
         validator.validate(manifest).orElseThrow(ValidationFailureException::new);
 
         var decoded = onEncoded(participantId).orElseThrow(InvalidRequestException::new);
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformer.java b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformer.java
index 88a233556..de0e29817 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformer.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformer.java
@@ -39,7 +39,7 @@ public Class<VerifiableCredentialResource> getOutputType() {
         var container = manifest.getVerifiableCredentialContainer();
         return VerifiableCredentialResource.Builder.newInstance()
                 .id(manifest.getId())
-                .participantId(manifest.getParticipantId())
+                .participantContextId(manifest.getParticipantContextId())
                 .issuerId(container.credential().getIssuer().id())
                 .holderId(container.credential().getCredentialSubject().stream().findFirst().get().getId())
                 .state(VcStatus.ISSUED)
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiControllerTest.java b/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiControllerTest.java
index cb5858ccf..0a264539d 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiControllerTest.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/VerifiableCredentialsApiControllerTest.java
@@ -21,12 +21,12 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
 import org.eclipse.edc.identityhub.api.Versions;
-import org.eclipse.edc.identityhub.api.v1.validation.VerifiableCredentialManifestValidator;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.api.verifiablecredential.validation.VerifiableCredentialManifestValidator;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialManifest;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.junit.annotations.ApiTest;
 import org.eclipse.edc.spi.result.Result;
 import org.eclipse.edc.spi.result.ServiceResult;
@@ -102,7 +102,7 @@ private VerifiableCredentialResource.Builder createCredentialResource(String...
     private VerifiableCredentialManifest createManifest(VerifiableCredential credential) {
         return VerifiableCredentialManifest.Builder.newInstance()
                 .id(UUID.randomUUID().toString())
-                .participantId(PARTICIPANT_ID)
+                .participantContextId(PARTICIPANT_ID)
                 .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JSON_LD, credential))
                 .build();
     }
diff --git a/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformerTest.java b/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformerTest.java
index 6a10cd608..497e26cea 100644
--- a/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformerTest.java
+++ b/extensions/api/identity-api/verifiable-credentials-api/src/test/java/org/eclipse/edc/identityhub/api/verifiablecredentials/v1/unstable/transformer/VerifiableCredentialManifestToVerifiableCredentialResourceTransformerTest.java
@@ -43,7 +43,7 @@ void transform_success() {
                 .build();
         var manifest = VerifiableCredentialManifest.Builder.newInstance()
                 .id("id")
-                .participantId("participantId")
+                .participantContextId("participantId")
                 .issuancePolicy(mock())
                 .reissuancePolicy(mock())
                 .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, credential))
@@ -53,7 +53,7 @@ void transform_success() {
 
         assertNotNull(resource);
         assertThat(resource.getId()).isEqualTo(manifest.getId());
-        assertThat(resource.getParticipantId()).isEqualTo(manifest.getParticipantId());
+        assertThat(resource.getParticipantContextId()).isEqualTo(manifest.getParticipantContextId());
         assertThat(resource.getIssuancePolicy()).isEqualTo(manifest.getIssuancePolicy());
         assertThat(resource.getReissuancePolicy()).isEqualTo(manifest.getReissuancePolicy());
         assertThat(resource.getVerifiableCredential()).isEqualTo(manifest.getVerifiableCredentialContainer());
diff --git a/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthenticationExtension.java b/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthenticationExtension.java
index 4041fcc91..e444ae5e5 100644
--- a/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthenticationExtension.java
+++ b/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthenticationExtension.java
@@ -16,8 +16,8 @@
 
 import org.eclipse.edc.identityhub.api.authentication.filter.RoleBasedAccessFeature;
 import org.eclipse.edc.identityhub.api.authentication.filter.ServicePrincipalAuthenticationFilter;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.spi.security.Vault;
diff --git a/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ParticipantServicePrincipalResolver.java b/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ParticipantServicePrincipalResolver.java
index 5e6f5d0a0..8843c39bb 100644
--- a/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ParticipantServicePrincipalResolver.java
+++ b/extensions/api/identityhub-api-authentication/src/main/java/org/eclipse/edc/identityhub/api/ParticipantServicePrincipalResolver.java
@@ -70,11 +70,11 @@ private ServicePrincipal findByPrincipal(String principal) {
 
     private ServicePrincipal toUser(ParticipantContext participantContext) {
         var credential = vault.resolveSecret(participantContext.getApiTokenAlias());
-        var participantId = participantContext.getParticipantId();
+        var participantContextId = participantContext.getParticipantContextId();
         return new ServicePrincipal() {
             @Override
             public String getPrincipal() {
-                return participantId;
+                return participantContextId;
             }
 
             @Override
diff --git a/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthorizationExtension.java b/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthorizationExtension.java
index 291761188..d9366c413 100644
--- a/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthorizationExtension.java
+++ b/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/ApiAuthorizationExtension.java
@@ -15,7 +15,7 @@
 package org.eclipse.edc.identityhub.api;
 
 import org.eclipse.edc.identityhub.api.authorization.AuthorizationServiceImpl;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
 import org.eclipse.edc.spi.system.ServiceExtension;
diff --git a/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImpl.java b/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImpl.java
index c8363dc63..a47e877c7 100644
--- a/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImpl.java
+++ b/extensions/api/identityhub-api-authorization/src/main/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImpl.java
@@ -15,8 +15,8 @@
 package org.eclipse.edc.identityhub.api.authorization;
 
 import jakarta.ws.rs.core.SecurityContext;
-import org.eclipse.edc.identityhub.spi.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.authentication.ServicePrincipal;
+import org.eclipse.edc.identityhub.spi.authorization.AuthorizationService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
 import org.eclipse.edc.spi.result.ServiceResult;
 
@@ -43,7 +43,7 @@ public ServiceResult<Void> isAuthorized(SecurityContext securityContext, String
 
         var result = function.apply(resourceId);
         if (result != null) {
-            return Objects.equals(result.getParticipantId(), name)
+            return Objects.equals(result.getParticipantContextId(), name)
                     ? ServiceResult.success()
                     : ServiceResult.unauthorized("User '%s' is not authorized to access resource of type %s with ID '%s'.".formatted(name, resourceClass, resourceId));
         }
diff --git a/extensions/api/identityhub-api-authorization/src/test/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImplTest.java b/extensions/api/identityhub-api-authorization/src/test/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImplTest.java
index 9f00309b0..3651dad88 100644
--- a/extensions/api/identityhub-api-authorization/src/test/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImplTest.java
+++ b/extensions/api/identityhub-api-authorization/src/test/java/org/eclipse/edc/identityhub/api/authorization/AuthorizationServiceImplTest.java
@@ -35,7 +35,7 @@ class AuthorizationServiceImplTest {
     void isAuthorized_whenAuthorized() {
         authorizationService.addLookupFunction(TestResource.class, s -> new ParticipantResource() {
             @Override
-            public String getParticipantId() {
+            public String getParticipantContextId() {
                 return "test-id";
             }
         });
@@ -62,7 +62,7 @@ void isAuthorized_whenNoLookupFunction() {
     void isAuthorized_whenNotAuthorized() {
         authorizationService.addLookupFunction(TestResource.class, s -> new ParticipantResource() {
             @Override
-            public String getParticipantId() {
+            public String getParticipantContextId() {
                 return "another-test-id";
             }
         });
diff --git a/extensions/common/credential-watchdog/build.gradle.kts b/extensions/common/credential-watchdog/build.gradle.kts
index d4d77f1d3..737a27418 100644
--- a/extensions/common/credential-watchdog/build.gradle.kts
+++ b/extensions/common/credential-watchdog/build.gradle.kts
@@ -20,7 +20,6 @@ plugins {
 dependencies {
 
     api(project(":spi:verifiable-credential-spi"))
-    api(project(":spi:identity-hub-store-spi"))
     implementation(libs.edc.spi.transaction)
 
     testImplementation(libs.edc.junit)
diff --git a/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdog.java b/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdog.java
index 4ef3d7b90..57f0ac6bd 100644
--- a/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdog.java
+++ b/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdog.java
@@ -14,9 +14,9 @@
 
 package org.eclipse.edc.identityhub.common.credentialwatchdog;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.CredentialStatusCheckService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
diff --git a/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogExtension.java b/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogExtension.java
index 0910c96f6..459da9945 100644
--- a/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogExtension.java
+++ b/extensions/common/credential-watchdog/src/main/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogExtension.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.common.credentialwatchdog;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.CredentialStatusCheckService;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Setting;
diff --git a/extensions/common/credential-watchdog/src/test/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogTest.java b/extensions/common/credential-watchdog/src/test/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogTest.java
index 6505618da..aa0cf211b 100644
--- a/extensions/common/credential-watchdog/src/test/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogTest.java
+++ b/extensions/common/credential-watchdog/src/test/java/org/eclipse/edc/identityhub/common/credentialwatchdog/CredentialWatchdogTest.java
@@ -19,10 +19,10 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.Issuer;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.CredentialStatusCheckService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.result.Result;
 import org.eclipse.edc.spi.result.StoreResult;
 import org.eclipse.edc.transaction.spi.NoopTransactionContext;
@@ -126,7 +126,7 @@ private VerifiableCredentialResource.Builder createCredentialBuilder() {
                 .issuerId("test-issuer")
                 .holderId("test-holder")
                 .state(VcStatus.ISSUED)
-                .participantId("participant-id")
+                .participantContextId("participant-id")
                 .credential(new VerifiableCredentialContainer("raw-vc-content", CredentialFormat.JSON_LD, createVerifiableCredential().build()))
                 .id(UUID.randomUUID().toString());
     }
diff --git a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentListenerImpl.java b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentListenerImpl.java
index f3fc01729..dd3916fad 100644
--- a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentListenerImpl.java
+++ b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentListenerImpl.java
@@ -15,10 +15,10 @@
 package org.eclipse.edc.identityhub.publisher.did.local;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentEvent;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentListener;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentPublished;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentUnpublished;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentEvent;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentListener;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentPublished;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentUnpublished;
 import org.eclipse.edc.spi.event.EventEnvelope;
 import org.eclipse.edc.spi.event.EventRouter;
 
@@ -37,7 +37,7 @@ public DidDocumentListenerImpl(Clock clock, EventRouter eventRouter) {
     @Override
     public void published(DidDocument document, String participantId) {
         var event = DidDocumentPublished.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .did(document.getId())
                 .build();
         publish(event);
@@ -46,7 +46,7 @@ public void published(DidDocument document, String participantId) {
     @Override
     public void unpublished(DidDocument document, String participantId) {
         var event = DidDocumentUnpublished.Builder.newInstance()
-                .participantId(participantId)
+                .participantContextId(participantId)
                 .did(document.getId())
                 .build();
         publish(event);
diff --git a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentObservableImpl.java b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentObservableImpl.java
index 4901876b2..83c0b579c 100644
--- a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentObservableImpl.java
+++ b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidDocumentObservableImpl.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.publisher.did.local;
 
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentListener;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentObservable;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentListener;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentObservable;
 import org.eclipse.edc.spi.observe.ObservableImpl;
 
 public class DidDocumentObservableImpl extends ObservableImpl<DidDocumentListener> implements DidDocumentObservable {
diff --git a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebController.java b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebController.java
index 4806013ba..08dd1d319 100644
--- a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebController.java
+++ b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebController.java
@@ -21,10 +21,10 @@
 import jakarta.ws.rs.container.ContainerRequestContext;
 import jakarta.ws.rs.core.Context;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.DidWebParser;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidWebParser;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
@@ -68,7 +68,6 @@ public DidDocument getDidDocument(@Context ContainerRequestContext context) {
                 .filter(new Criterion("did", "=", did))
                 .build();
 
-        monitor.debug("Looking up '%s'".formatted(did));
         var dids = didResourceStore.query(q)
                 .stream()
                 .map(DidResource::getDocument)
diff --git a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisher.java b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisher.java
index d7d0780e5..485d3dfd1 100644
--- a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisher.java
+++ b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisher.java
@@ -14,15 +14,15 @@
 
 package org.eclipse.edc.identityhub.publisher.did.local;
 
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisher;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentObservable;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisher;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentObservable;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.result.Result;
 
-import static org.eclipse.edc.identithub.spi.did.DidConstants.DID_WEB_METHOD_REGEX;
+import static org.eclipse.edc.identityhub.spi.did.DidConstants.DID_WEB_METHOD_REGEX;
 import static org.eclipse.edc.spi.result.Result.failure;
 import static org.eclipse.edc.spi.result.Result.success;
 
@@ -64,7 +64,7 @@ public Result<Void> publish(String did) {
         return didResourceStore.update(existingDocument)
                 .map(v -> success())
                 .orElse(f -> failure(f.getFailureDetail()))
-                .onSuccess(v -> observable.invokeForEach(l -> l.published(existingDocument.getDocument(), existingDocument.getParticipantId())));
+                .onSuccess(v -> observable.invokeForEach(l -> l.published(existingDocument.getDocument(), existingDocument.getParticipantContextId())));
     }
 
     @Override
@@ -78,7 +78,7 @@ public Result<Void> unpublish(String did) {
         return didResourceStore.update(existingDocument)
                 .map(v -> success())
                 .orElse(f -> failure(f.getFailureDetail()))
-                .onSuccess(v -> observable.invokeForEach(l -> l.unpublished(existingDocument.getDocument(), existingDocument.getParticipantId())));
+                .onSuccess(v -> observable.invokeForEach(l -> l.unpublished(existingDocument.getDocument(), existingDocument.getParticipantContextId())));
 
     }
 
diff --git a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherExtension.java b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherExtension.java
index 38220d5d7..5af60386c 100644
--- a/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherExtension.java
+++ b/extensions/did/local-did-publisher/src/main/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherExtension.java
@@ -14,12 +14,12 @@
 
 package org.eclipse.edc.identityhub.publisher.did.local;
 
-import org.eclipse.edc.identithub.spi.did.DidConstants;
-import org.eclipse.edc.identithub.spi.did.DidDocumentPublisherRegistry;
-import org.eclipse.edc.identithub.spi.did.DidWebParser;
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentObservable;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
-import org.eclipse.edc.identityhub.spi.IdentityHubApiContext;
+import org.eclipse.edc.identityhub.spi.did.DidConstants;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentPublisherRegistry;
+import org.eclipse.edc.identityhub.spi.did.DidWebParser;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentObservable;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext;
 import org.eclipse.edc.runtime.metamodel.annotation.Configuration;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
@@ -36,7 +36,7 @@
 import java.time.Clock;
 
 import static org.eclipse.edc.identityhub.publisher.did.local.LocalDidPublisherExtension.NAME;
-import static org.eclipse.edc.identityhub.spi.IdentityHubApiContext.IH_DID;
+import static org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext.IH_DID;
 
 @Extension(value = NAME)
 public class LocalDidPublisherExtension implements ServiceExtension {
diff --git a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebControllerTest.java b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebControllerTest.java
index 9dc0f0656..ffef99bd6 100644
--- a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebControllerTest.java
+++ b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/DidWebControllerTest.java
@@ -16,10 +16,10 @@
 
 import io.restassured.specification.RequestSpecification;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.DidWebParser;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.DidWebParser;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.junit.annotations.ApiTest;
 import org.eclipse.edc.web.jersey.testfixtures.RestControllerTestBase;
 import org.junit.jupiter.api.Test;
diff --git a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherTest.java b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherTest.java
index e16eb086c..d9f6c06b5 100644
--- a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherTest.java
+++ b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/LocalDidPublisherTest.java
@@ -14,9 +14,9 @@
 
 package org.eclipse.edc.identityhub.publisher.did.local;
 
-import org.eclipse.edc.identithub.spi.did.events.DidDocumentObservable;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.events.DidDocumentObservable;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.junit.assertions.AbstractResultAssert;
 import org.eclipse.edc.spi.monitor.Monitor;
 import org.eclipse.edc.spi.result.StoreResult;
@@ -51,13 +51,13 @@ void setUp() {
 
 
     @ParameterizedTest
-    @ValueSource(strings = { DID, "DID:web:test", "DID:WEB:TEST" })
+    @ValueSource(strings = {DID, "DID:web:test", "DID:WEB:TEST"})
     void canHandle(String validDid) {
         assertThat(publisher.canHandle(validDid)).isTrue();
     }
 
     @ParameterizedTest
-    @ValueSource(strings = { "did:web", "DID:web:", "did:indy:whatever", "dod:web:something" })
+    @ValueSource(strings = {"did:web", "DID:web:", "did:indy:whatever", "dod:web:something"})
     void canHandle_invalid(String validDid) {
         assertThat(publisher.canHandle(validDid)).isFalse();
     }
diff --git a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/TestFunctions.java b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/TestFunctions.java
index 0ff96a18f..3e7f2bcae 100644
--- a/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/TestFunctions.java
+++ b/extensions/did/local-did-publisher/src/test/java/org/eclipse/edc/identityhub/publisher/did/local/TestFunctions.java
@@ -15,8 +15,8 @@
 package org.eclipse.edc.identityhub.publisher.did.local;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
 
 public interface TestFunctions {
     static DidResource.Builder createDidResource() {
diff --git a/core/presentation-api/build.gradle.kts b/extensions/protocols/dcp/presentation-api/build.gradle.kts
similarity index 100%
rename from core/presentation-api/build.gradle.kts
rename to extensions/protocols/dcp/presentation-api/build.gradle.kts
diff --git a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java
similarity index 92%
rename from core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java
rename to extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java
index 5eebfd6c7..3985fd30c 100644
--- a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java
+++ b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/PresentationApiExtension.java
@@ -18,12 +18,12 @@
 import org.eclipse.edc.iam.identitytrust.spi.model.PresentationQueryMessage;
 import org.eclipse.edc.iam.identitytrust.transform.from.JsonObjectFromPresentationResponseMessageTransformer;
 import org.eclipse.edc.iam.identitytrust.transform.to.JsonObjectToPresentationQueryTransformer;
-import org.eclipse.edc.identityhub.api.v1.PresentationApiController;
 import org.eclipse.edc.identityhub.api.validation.PresentationQueryValidator;
+import org.eclipse.edc.identityhub.api.verifiablecredential.PresentationApiController;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.VerifiablePresentationService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.CredentialQueryResolver;
-import org.eclipse.edc.identityhub.spi.verification.AccessTokenVerifier;
+import org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenVerifier;
 import org.eclipse.edc.jsonld.spi.JsonLd;
 import org.eclipse.edc.runtime.metamodel.annotation.Configuration;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
@@ -50,8 +50,8 @@
 
 import static org.eclipse.edc.iam.identitytrust.spi.DcpConstants.DCP_CONTEXT_URL;
 import static org.eclipse.edc.identityhub.api.PresentationApiExtension.NAME;
-import static org.eclipse.edc.identityhub.spi.IdentityHubApiContext.PRESENTATION;
-import static org.eclipse.edc.identityhub.spi.IdentityHubApiContext.RESOLUTION;
+import static org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext.PRESENTATION;
+import static org.eclipse.edc.identityhub.spi.webcontext.IdentityHubApiContext.RESOLUTION;
 import static org.eclipse.edc.spi.constants.CoreConstants.JSON_LD;
 
 @Extension(value = NAME)
@@ -71,7 +71,7 @@ public class PresentationApiExtension implements ServiceExtension {
     @Inject
     private WebService webService;
     @Inject
-    private AccessTokenVerifier accessTokenVerifier;
+    private SelfIssuedTokenVerifier selfIssuedTokenVerifier;
     @Inject
     private CredentialQueryResolver credentialResolver;
     @Inject
@@ -102,7 +102,7 @@ public void initialize(ServiceExtensionContext context) {
         var jsonLdMapper = typeManager.getMapper(JSON_LD);
 
 
-        var controller = new PresentationApiController(validatorRegistry, typeTransformer, credentialResolver, accessTokenVerifier, verifiablePresentationService, context.getMonitor(), participantContextService);
+        var controller = new PresentationApiController(validatorRegistry, typeTransformer, credentialResolver, selfIssuedTokenVerifier, verifiablePresentationService, context.getMonitor(), participantContextService);
         webService.registerResource(contextString, new ObjectMapperProvider(jsonLdMapper));
         webService.registerResource(contextString, new JerseyJsonLdInterceptor(jsonLd, jsonLdMapper, PRESENTATION_SCOPE));
         webService.registerResource(contextString, controller);
diff --git a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/validation/PresentationQueryValidator.java b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/validation/PresentationQueryValidator.java
similarity index 100%
rename from core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/validation/PresentationQueryValidator.java
rename to extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/validation/PresentationQueryValidator.java
diff --git a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/ApiSchema.java b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ApiSchema.java
similarity index 98%
rename from core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/ApiSchema.java
rename to extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ApiSchema.java
index 13fda8d96..2461fa7ba 100644
--- a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/ApiSchema.java
+++ b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/ApiSchema.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1;
+package org.eclipse.edc.identityhub.api.verifiablecredential;
 
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.json.JsonObject;
diff --git a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApi.java b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApi.java
similarity index 98%
rename from core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApi.java
rename to extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApi.java
index d2597522a..bb8582b96 100644
--- a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApi.java
+++ b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApi.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1;
+package org.eclipse.edc.identityhub.api.verifiablecredential;
 
 
 import io.swagger.v3.oas.annotations.OpenAPIDefinition;
diff --git a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApiController.java b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApiController.java
similarity index 86%
rename from core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApiController.java
rename to extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApiController.java
index 381846259..42f94fbcd 100644
--- a/core/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/v1/PresentationApiController.java
+++ b/extensions/protocols/dcp/presentation-api/src/main/java/org/eclipse/edc/identityhub/api/verifiablecredential/PresentationApiController.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.api.v1;
+package org.eclipse.edc.identityhub.api.verifiablecredential;
 
 import com.nimbusds.jwt.SignedJWT;
 import jakarta.json.JsonObject;
@@ -28,7 +28,7 @@
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.VerifiablePresentationService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.CredentialQueryResolver;
-import org.eclipse.edc.identityhub.spi.verification.AccessTokenVerifier;
+import org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenVerifier;
 import org.eclipse.edc.jwt.spi.JwtRegisteredClaimNames;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.monitor.Monitor;
@@ -52,23 +52,23 @@
 
 @Consumes(APPLICATION_JSON)
 @Produces(APPLICATION_JSON)
-@Path("/v1/participants/{participantId}/presentations")
+@Path("/v1/participants/{participantContextId}/presentations")
 public class PresentationApiController implements PresentationApi {
 
     private final JsonObjectValidatorRegistry validatorRegistry;
     private final TypeTransformerRegistry transformerRegistry;
     private final CredentialQueryResolver queryResolver;
-    private final AccessTokenVerifier accessTokenVerifier;
+    private final SelfIssuedTokenVerifier selfIssuedTokenVerifier;
     private final VerifiablePresentationService verifiablePresentationService;
     private final Monitor monitor;
     private final ParticipantContextService participantContextService;
 
     public PresentationApiController(JsonObjectValidatorRegistry validatorRegistry, TypeTransformerRegistry transformerRegistry, CredentialQueryResolver queryResolver,
-                                     AccessTokenVerifier accessTokenVerifier, VerifiablePresentationService verifiablePresentationService, Monitor monitor, ParticipantContextService participantContextService) {
+                                     SelfIssuedTokenVerifier selfIssuedTokenVerifier, VerifiablePresentationService verifiablePresentationService, Monitor monitor, ParticipantContextService participantContextService) {
         this.validatorRegistry = validatorRegistry;
         this.transformerRegistry = transformerRegistry;
         this.queryResolver = queryResolver;
-        this.accessTokenVerifier = accessTokenVerifier;
+        this.selfIssuedTokenVerifier = selfIssuedTokenVerifier;
         this.verifiablePresentationService = verifiablePresentationService;
         this.monitor = monitor;
         this.participantContextService = participantContextService;
@@ -78,7 +78,7 @@ public PresentationApiController(JsonObjectValidatorRegistry validatorRegistry,
     @POST
     @Path("/query")
     @Override
-    public Response queryPresentation(@PathParam("participantId") String participantContextId, JsonObject query, @HeaderParam(AUTHORIZATION) String token) {
+    public Response queryPresentation(@PathParam("participantContextId") String participantContextId, JsonObject query, @HeaderParam(AUTHORIZATION) String token) {
         if (token == null) {
             throw new AuthenticationFailedException("Authorization header missing");
         }
@@ -101,7 +101,7 @@ public Response queryPresentation(@PathParam("participantId") String participant
 
 
         // verify and validate the requestor's SI token
-        var issuerScopes = accessTokenVerifier.verify(token, participantContextId).orElseThrow(f -> new AuthenticationFailedException("ID token verification failed: %s".formatted(f.getFailureDetail())));
+        var issuerScopes = selfIssuedTokenVerifier.verify(token, participantContextId).orElseThrow(f -> new AuthenticationFailedException("ID token verification failed: %s".formatted(f.getFailureDetail())));
 
         // query the database
         var credentials = queryResolver.query(participantContextId, presentationQuery, issuerScopes).orElseThrow(f -> new NotAuthorizedException(f.getFailureDetail()));
diff --git a/core/presentation-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension b/extensions/protocols/dcp/presentation-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
similarity index 100%
rename from core/presentation-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
rename to extensions/protocols/dcp/presentation-api/src/main/resources/META-INF/services/org.eclipse.edc.spi.system.ServiceExtension
diff --git a/core/presentation-api/src/main/resources/presentation-api-version.json b/extensions/protocols/dcp/presentation-api/src/main/resources/presentation-api-version.json
similarity index 65%
rename from core/presentation-api/src/main/resources/presentation-api-version.json
rename to extensions/protocols/dcp/presentation-api/src/main/resources/presentation-api-version.json
index ad7bbb970..097430628 100644
--- a/core/presentation-api/src/main/resources/presentation-api-version.json
+++ b/extensions/protocols/dcp/presentation-api/src/main/resources/presentation-api-version.json
@@ -2,7 +2,7 @@
   {
     "version": "1.0.0",
     "urlPath": "/v1",
-    "lastUpdated": "2025-01-16T09:00:00Z",
+    "lastUpdated": "2025-01-16T12:00:00Z",
     "maturity": "stable"
   }
 ]
\ No newline at end of file
diff --git a/core/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java b/extensions/protocols/dcp/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java
similarity index 91%
rename from core/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java
rename to extensions/protocols/dcp/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java
index e8bc76db7..81d39c3bc 100644
--- a/core/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java
+++ b/extensions/protocols/dcp/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/v1/PresentationApiControllerTest.java
@@ -22,13 +22,13 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.credentialservice.InputDescriptorMapping;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.credentialservice.PresentationSubmission;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.presentationdefinition.PresentationDefinition;
-import org.eclipse.edc.identityhub.api.v1.PresentationApiController;
+import org.eclipse.edc.identityhub.api.verifiablecredential.PresentationApiController;
 import org.eclipse.edc.identityhub.spi.participantcontext.ParticipantContextService;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.generator.VerifiablePresentationService;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.CredentialQueryResolver;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.resolution.QueryResult;
-import org.eclipse.edc.identityhub.spi.verification.AccessTokenVerifier;
+import org.eclipse.edc.identityhub.spi.verification.SelfIssuedTokenVerifier;
 import org.eclipse.edc.junit.annotations.ApiTest;
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.result.Result;
@@ -75,10 +75,10 @@ class PresentationApiControllerTest extends RestControllerTestBase {
     private final JsonObjectValidatorRegistry validatorRegistryMock = mock();
     private final TypeTransformerRegistry typeTransformerRegistry = mock();
     private final CredentialQueryResolver queryResolver = mock();
-    private final AccessTokenVerifier accessTokenVerifier = mock();
+    private final SelfIssuedTokenVerifier selfIssuedTokenVerifier = mock();
     private final VerifiablePresentationService generator = mock();
     private final ParticipantContextService participantContextService = mock(a -> ServiceResult.success(ParticipantContext.Builder.newInstance()
-            .participantId(a.getArgument(0).toString())
+            .participantContextId(a.getArgument(0).toString())
             .apiTokenAlias("test-alias")
             .build()));
 
@@ -106,7 +106,7 @@ void query_transformationError_shouldReturn400() {
         assertThatThrownBy(() -> controller().queryPresentation(PARTICIPANT_ID, createObjectBuilder().build(), generateJwt()))
                 .isInstanceOf(InvalidRequestException.class)
                 .hasMessage("cannot transform");
-        verifyNoInteractions(accessTokenVerifier, queryResolver, generator);
+        verifyNoInteractions(selfIssuedTokenVerifier, queryResolver, generator);
     }
 
     @Test
@@ -122,7 +122,7 @@ void query_withPresentationDefinition_shouldReturn501() {
             assertThat(ed.getMessage()).isEqualTo("Not implemented.");
             assertThat(ed.getType()).isEqualTo("Not implemented.");
         });
-        verifyNoInteractions(accessTokenVerifier, queryResolver, generator);
+        verifyNoInteractions(selfIssuedTokenVerifier, queryResolver, generator);
     }
 
 
@@ -131,7 +131,7 @@ void query_tokenVerificationFails_shouldReturn401() {
         when(validatorRegistryMock.validate(eq(PRESENTATION_QUERY_MESSAGE_TYPE_PROPERTY), any())).thenReturn(success());
         var presentationQueryBuilder = createPresentationQueryBuilder().build();
         when(typeTransformerRegistry.transform(isA(JsonObject.class), eq(PresentationQueryMessage.class))).thenReturn(Result.success(presentationQueryBuilder));
-        when(accessTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.failure("test-failure"));
+        when(selfIssuedTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.failure("test-failure"));
 
         assertThatThrownBy(() -> controller().queryPresentation(PARTICIPANT_ID, createObjectBuilder().build(), generateJwt()))
                 .isExactlyInstanceOf(AuthenticationFailedException.class)
@@ -144,7 +144,7 @@ void query_queryResolutionFails_shouldReturn403() {
         when(validatorRegistryMock.validate(eq(PRESENTATION_QUERY_MESSAGE_TYPE_PROPERTY), any())).thenReturn(success());
         var presentationQueryBuilder = createPresentationQueryBuilder().build();
         when(typeTransformerRegistry.transform(isA(JsonObject.class), eq(PresentationQueryMessage.class))).thenReturn(Result.success(presentationQueryBuilder));
-        when(accessTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
+        when(selfIssuedTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
         when(queryResolver.query(anyString(), any(), eq(List.of("test-scope1")))).thenReturn(QueryResult.unauthorized("test-failure"));
 
         assertThatThrownBy(() -> controller().queryPresentation(PARTICIPANT_ID, createObjectBuilder().build(), generateJwt()))
@@ -158,7 +158,7 @@ void query_presentationGenerationFails_shouldReturn500() {
         when(validatorRegistryMock.validate(eq(PRESENTATION_QUERY_MESSAGE_TYPE_PROPERTY), any())).thenReturn(success());
         var presentationQueryBuilder = createPresentationQueryBuilder().build();
         when(typeTransformerRegistry.transform(isA(JsonObject.class), eq(PresentationQueryMessage.class))).thenReturn(Result.success(presentationQueryBuilder));
-        when(accessTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
+        when(selfIssuedTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
         when(queryResolver.query(anyString(), any(), eq(List.of("test-scope1")))).thenReturn(QueryResult.success(Stream.empty()));
 
         when(generator.createPresentation(anyString(), anyList(), any(), any())).thenReturn(Result.failure("test-failure"));
@@ -173,7 +173,7 @@ void query_success() {
         when(validatorRegistryMock.validate(eq(PRESENTATION_QUERY_MESSAGE_TYPE_PROPERTY), any())).thenReturn(success());
         var presentationQueryBuilder = createPresentationQueryBuilder().build();
         when(typeTransformerRegistry.transform(isA(JsonObject.class), eq(PresentationQueryMessage.class))).thenReturn(Result.success(presentationQueryBuilder));
-        when(accessTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
+        when(selfIssuedTokenVerifier.verify(anyString(), anyString())).thenReturn(Result.success(List.of("test-scope1")));
         when(queryResolver.query(anyString(), any(), eq(List.of("test-scope1")))).thenReturn(QueryResult.success(Stream.empty()));
 
         var pres = PresentationResponseMessage.Builder.newinstance().presentation(List.of(generateJwt()))
@@ -193,7 +193,7 @@ void query_success() {
 
     @Override
     protected PresentationApiController controller() {
-        return new PresentationApiController(validatorRegistryMock, typeTransformerRegistry, queryResolver, accessTokenVerifier, generator, mock(), participantContextService);
+        return new PresentationApiController(validatorRegistryMock, typeTransformerRegistry, queryResolver, selfIssuedTokenVerifier, generator, mock(), participantContextService);
     }
 
     private String generateJwt() {
diff --git a/core/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/validation/PresentationQueryValidatorTest.java b/extensions/protocols/dcp/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/validation/PresentationQueryValidatorTest.java
similarity index 100%
rename from core/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/validation/PresentationQueryValidatorTest.java
rename to extensions/protocols/dcp/presentation-api/src/test/java/org/eclipse/edc/identityservice/api/validation/PresentationQueryValidatorTest.java
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/build.gradle.kts b/extensions/store/sql/identity-hub-credentials-store-sql/build.gradle.kts
index 3aa200b3a..d2d1d4b68 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/build.gradle.kts
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/build.gradle.kts
@@ -17,13 +17,13 @@ plugins {
 }
 
 dependencies {
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:verifiable-credential-spi"))
     implementation(libs.edc.lib.sql)
     implementation(libs.edc.lib.util)
     implementation(libs.edc.sql.bootstrapper) // for the schema bootstrapper
     implementation(libs.edc.spi.transaction.datasource)
 
-    testImplementation(testFixtures(project(":spi:identity-hub-store-spi")))
+    testImplementation(testFixtures(project(":spi:verifiable-credential-spi")))
     testImplementation(testFixtures(libs.edc.sql.test.fixtures))
     testImplementation(libs.edc.junit)
 }
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/BaseSqlDialectStatements.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/BaseSqlDialectStatements.java
index 1172fcd01..5b1836ebd 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/BaseSqlDialectStatements.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/BaseSqlDialectStatements.java
@@ -35,7 +35,7 @@ public String getInsertTemplate() {
                 .column(getVcFormatColumn())
                 .column(getRawVcColumn())
                 .jsonColumn(getVerifiableCredentialColumn())
-                .column(getParticipantIdColumn())
+                .column(getParticipantContextIdColumn())
                 .insertInto(getCredentialResourceTable());
     }
 
@@ -52,7 +52,7 @@ public String getUpdateTemplate() {
                 .column(getVcFormatColumn())
                 .column(getRawVcColumn())
                 .jsonColumn(getVerifiableCredentialColumn())
-                .column(getParticipantIdColumn())
+                .column(getParticipantContextIdColumn())
                 .update(getCredentialResourceTable(), getIdColumn());
     }
 
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/CredentialStoreStatements.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/CredentialStoreStatements.java
index 15e233efe..312149af6 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/CredentialStoreStatements.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/CredentialStoreStatements.java
@@ -14,12 +14,13 @@
 
 package org.eclipse.edc.identityhub.store.sql.credentials;
 
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.sql.statement.SqlStatements;
 import org.eclipse.edc.sql.translation.SqlQueryStatement;
 
 /**
- * Defines SQL-statements and column names for use with a SQL-based {@link org.eclipse.edc.identityhub.spi.store.CredentialStore}
+ * Defines SQL-statements and column names for use with a SQL-based {@link CredentialStore}
  */
 public interface CredentialStoreStatements extends SqlStatements {
     default String getCredentialResourceTable() {
@@ -66,8 +67,8 @@ default String getVerifiableCredentialColumn() {
         return "verifiable_credential";
     }
 
-    default String getParticipantIdColumn() {
-        return "participant_id";
+    default String getParticipantContextIdColumn() {
+        return "participant_context_id";
     }
 
     String getInsertTemplate();
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStore.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStore.java
index f3b900ac1..92c464777 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStore.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStore.java
@@ -18,9 +18,9 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.policy.model.Policy;
 import org.eclipse.edc.spi.persistence.EdcPersistenceException;
 import org.eclipse.edc.spi.query.QuerySpec;
@@ -73,7 +73,7 @@ public StoreResult<Void> create(VerifiableCredentialResource credentialResource)
                         credentialResource.getVerifiableCredential().format().ordinal(),
                         credentialResource.getVerifiableCredential().rawVc(),
                         toJson(credentialResource.getVerifiableCredential().credential()),
-                        credentialResource.getParticipantId());
+                        credentialResource.getParticipantContextId());
                 return success();
 
             } catch (SQLException e) {
@@ -114,7 +114,7 @@ public StoreResult<Void> update(VerifiableCredentialResource credentialResource)
                             credentialResource.getVerifiableCredential().format().ordinal(),
                             credentialResource.getVerifiableCredential().rawVc(),
                             toJson(credentialResource.getVerifiableCredential().credential()),
-                            credentialResource.getParticipantId(),
+                            credentialResource.getParticipantContextId(),
                             id);
                     return StoreResult.success();
                 }
@@ -166,7 +166,7 @@ private VerifiableCredentialResource mapResultSet(ResultSet resultSet) throws Ex
                 .issuancePolicy(fromJson(resultSet.getString(statements.getIssuancePolicyColumn()), Policy.class))
                 .reissuancePolicy(fromJson(resultSet.getString(statements.getReissuancePolicyColumn()), Policy.class))
                 .credential(vcc)
-                .participantId(resultSet.getString(statements.getParticipantIdColumn()))
+                .participantContextId(resultSet.getString(statements.getParticipantContextIdColumn()))
                 .build();
     }
 }
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStoreExtension.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStoreExtension.java
index 8d435aa31..4f4f62550 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStoreExtension.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialStoreExtension.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.store.sql.credentials;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.identityhub.store.sql.credentials.schema.postgres.PostgresDialectStatements;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/schema/postgres/VerifiableCredentialResourceMapping.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/schema/postgres/VerifiableCredentialResourceMapping.java
index 143477b74..c8967393d 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/schema/postgres/VerifiableCredentialResourceMapping.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/credentials/schema/postgres/VerifiableCredentialResourceMapping.java
@@ -32,7 +32,7 @@ public class VerifiableCredentialResourceMapping extends TranslationMapping {
     public static final String FIELD_ISSUANCE_POLICY = "issuancePolicy";
     public static final String FIELD_REISSUANCE_POLICY = "reissuancePolicy";
     public static final String FIELD_VERIFIABLE_CREDENTIAL = "verifiableCredential";
-    public static final String FIELD_PARTICIPANT_ID = "participantId";
+    public static final String FIELD_PARTICIPANT_CONTEXT_ID = "participantContextId";
 
     public VerifiableCredentialResourceMapping(CredentialStoreStatements statements) {
         add(FIELD_ID, statements.getIdColumn());
@@ -43,6 +43,6 @@ public VerifiableCredentialResourceMapping(CredentialStoreStatements statements)
         add(FIELD_ISSUANCE_POLICY, statements.getIssuancePolicyColumn());
         add(FIELD_REISSUANCE_POLICY, statements.getReissuancePolicyColumn());
         add(FIELD_VERIFIABLE_CREDENTIAL, new VerifiableCredentialContainerMapping(statements));
-        add(FIELD_PARTICIPANT_ID, statements.getParticipantIdColumn());
+        add(FIELD_PARTICIPANT_CONTEXT_ID, statements.getParticipantContextIdColumn());
     }
 }
\ No newline at end of file
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/resources/credentials-schema.sql b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/resources/credentials-schema.sql
index 140d8f923..86d035fae 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/main/resources/credentials-schema.sql
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/main/resources/credentials-schema.sql
@@ -25,7 +25,7 @@ CREATE TABLE IF NOT EXISTS credential_resource
     raw_vc                VARCHAR             NOT NULL, -- Representation of the VC exactly as it was received by the issuer. Can be JWT or JSON(-LD)
     vc_format             INTEGER             NOT NULL, -- 0 = JSON-LD, 1 = JWT
     verifiable_credential JSON                NOT NULL, -- JSON-representation of the verifiable credential
-    participant_id        VARCHAR                       -- ID of the ParticipantContext that owns this credentisl
+    participant_context_id        VARCHAR                       -- ID of the ParticipantContext that owns this credentisl
 );
 CREATE UNIQUE INDEX IF NOT EXISTS credential_resource_credential_id_uindex ON credential_resource USING btree (id);
 COMMENT ON COLUMN credential_resource.id IS 'ID of the VC, duplicated here for indexing purposes';
diff --git a/extensions/store/sql/identity-hub-credentials-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialsStoreTest.java b/extensions/store/sql/identity-hub-credentials-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialsStoreTest.java
index 67686e642..6f786d579 100644
--- a/extensions/store/sql/identity-hub-credentials-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialsStoreTest.java
+++ b/extensions/store/sql/identity-hub-credentials-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlCredentialsStoreTest.java
@@ -14,9 +14,9 @@
 
 package org.eclipse.edc.identityhub.store.sql.credentials;
 
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.identityhub.store.sql.credentials.schema.postgres.PostgresDialectStatements;
-import org.eclipse.edc.identityhub.store.test.CredentialStoreTestBase;
+import org.eclipse.edc.identityhub.verifiablecredentials.store.CredentialStoreTestBase;
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.junit.annotations.ComponentTest;
 import org.eclipse.edc.junit.testfixtures.TestUtils;
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/BaseSqlDialectStatements.java b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/BaseSqlDialectStatements.java
index 4d124294b..905ee05e0 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/BaseSqlDialectStatements.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/BaseSqlDialectStatements.java
@@ -30,7 +30,7 @@ public String getInsertTemplate() {
                 .column(getCreateTimestampColumn())
                 .column(getStateTimestampColumn())
                 .jsonColumn(getDidDocumentColumn())
-                .column(getParticipantId())
+                .column(getParticipantContextId())
                 .insertInto(getDidResourceTableName());
     }
 
@@ -42,7 +42,7 @@ public String getUpdateTemplate() {
                 .column(getCreateTimestampColumn())
                 .column(getStateTimestampColumn())
                 .jsonColumn(getDidDocumentColumn())
-                .column(getParticipantId())
+                .column(getParticipantContextId())
                 .update(getDidResourceTableName(), getIdColumn());
     }
 
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/DidResourceStatements.java b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/DidResourceStatements.java
index 8cfca76c3..fd30215b3 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/DidResourceStatements.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/DidResourceStatements.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.did.store.sql;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.sql.statement.SqlStatements;
 import org.eclipse.edc.sql.translation.SqlQueryStatement;
@@ -47,8 +47,8 @@ default String getDidDocumentColumn() {
         return "did_document";
     }
 
-    default String getParticipantId() {
-        return "participant_id";
+    default String getParticipantContextId() {
+        return "participant_context_id";
     }
 
     String getInsertTemplate();
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStore.java b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStore.java
index ddfa9c535..ecfdc3d59 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStore.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStore.java
@@ -16,8 +16,8 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.spi.persistence.EdcPersistenceException;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.StoreResult;
@@ -62,7 +62,7 @@ public StoreResult<Void> save(DidResource resource) {
                         resource.getCreateTimestamp(),
                         resource.getStateTimestamp(),
                         toJson(resource.getDocument()),
-                        resource.getParticipantId());
+                        resource.getParticipantContextId());
                 return StoreResult.success();
             } catch (SQLException e) {
                 throw new EdcPersistenceException(e);
@@ -84,7 +84,7 @@ public StoreResult<Void> update(DidResource resource) {
                             resource.getCreateTimestamp(),
                             resource.getStateTimestamp(),
                             toJson(resource.getDocument()),
-                            resource.getParticipantId(),
+                            resource.getParticipantContextId(),
                             did);
                     return StoreResult.success();
                 }
@@ -144,7 +144,7 @@ private DidResource mapResultSet(ResultSet resultSet) throws Exception {
                 .stateTimeStamp(resultSet.getLong(statements.getStateTimestampColumn()))
                 .document(fromJson(resultSet.getString(statements.getDidDocumentColumn()), DidDocument.class))
                 .state(resultSet.getInt(statements.getStateColumn()))
-                .participantId(resultSet.getString(statements.getParticipantId()))
+                .participantContextId(resultSet.getString(statements.getParticipantContextId()))
                 .build();
     }
 }
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreExtension.java b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreExtension.java
index eb7ce151f..18f12e671 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreExtension.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreExtension.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.did.store.sql;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.did.store.sql.schema.postgres.PostgresDialectStatements;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
 import org.eclipse.edc.runtime.metamodel.annotation.Provider;
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/schema/postgres/DidResourceMapping.java b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/schema/postgres/DidResourceMapping.java
index ea8eb94fc..240e83879 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/schema/postgres/DidResourceMapping.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/java/org/eclipse/edc/identityhub/did/store/sql/schema/postgres/DidResourceMapping.java
@@ -14,8 +14,8 @@
 
 package org.eclipse.edc.identityhub.did.store.sql.schema.postgres;
 
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
 import org.eclipse.edc.identityhub.did.store.sql.DidResourceStatements;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
 import org.eclipse.edc.sql.translation.TranslationMapping;
 
 
@@ -29,7 +29,7 @@ public class DidResourceMapping extends TranslationMapping {
     public static final String FIELD_CREATE_TIMESTAMP = "create_timestamp";
     public static final String FIELD_STATE_TIMESTAMP = "state_timestamp";
     public static final String FIELD_DOCUMENT = "document";
-    public static final String FIELD_PARTICIPANT_ID = "participantId";
+    public static final String FIELD_PARTICIPANT_CONTEXT_ID = "participantContextId";
 
 
     public DidResourceMapping(DidResourceStatements statements) {
@@ -38,6 +38,6 @@ public DidResourceMapping(DidResourceStatements statements) {
         add(FIELD_CREATE_TIMESTAMP, statements.getCreateTimestampColumn());
         add(FIELD_STATE_TIMESTAMP, statements.getStateTimestampColumn());
         add(FIELD_DOCUMENT, new DidDocumentMapping(statements));
-        add(FIELD_PARTICIPANT_ID, statements.getParticipantId());
+        add(FIELD_PARTICIPANT_CONTEXT_ID, statements.getParticipantContextId());
     }
 }
\ No newline at end of file
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/main/resources/did-schema.sql b/extensions/store/sql/identity-hub-did-store-sql/src/main/resources/did-schema.sql
index d4c3b6850..ba6746ba2 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/main/resources/did-schema.sql
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/main/resources/did-schema.sql
@@ -20,6 +20,6 @@ CREATE TABLE IF NOT EXISTS did_resources
     state_timestamp  BIGINT  NOT NULL,
     state            INT     NOT NULL,
     did_document     JSON    NOT NULL,
-    participant_id   VARCHAR,
+    participant_context_id   VARCHAR,
     PRIMARY KEY (did)
 );
diff --git a/extensions/store/sql/identity-hub-did-store-sql/src/test/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreTest.java b/extensions/store/sql/identity-hub-did-store-sql/src/test/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreTest.java
index 4a8c9b48f..53086d9c4 100644
--- a/extensions/store/sql/identity-hub-did-store-sql/src/test/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreTest.java
+++ b/extensions/store/sql/identity-hub-did-store-sql/src/test/java/org/eclipse/edc/identityhub/did/store/sql/SqlDidResourceStoreTest.java
@@ -14,9 +14,9 @@
 
 package org.eclipse.edc.identityhub.did.store.sql;
 
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.did.store.sql.schema.postgres.PostgresDialectStatements;
 import org.eclipse.edc.identityhub.did.store.test.DidResourceStoreTestBase;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.junit.annotations.ComponentTest;
 import org.eclipse.edc.junit.testfixtures.TestUtils;
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/build.gradle.kts b/extensions/store/sql/identity-hub-keypair-store-sql/build.gradle.kts
index a3ecac430..78c032029 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/build.gradle.kts
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/build.gradle.kts
@@ -17,12 +17,12 @@ plugins {
 }
 
 dependencies {
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:keypair-spi"))
     implementation(libs.edc.lib.sql)
     implementation(libs.edc.sql.bootstrapper)
     implementation(libs.edc.spi.transaction.datasource)
 
-    testImplementation(testFixtures(project(":spi:identity-hub-store-spi")))
+    testImplementation(testFixtures(project(":spi:keypair-spi")))
     testImplementation(testFixtures(libs.edc.sql.test.fixtures))
     testImplementation(libs.edc.junit)
 }
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/KeyPairResourceStoreStatements.java b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/KeyPairResourceStoreStatements.java
index 530e4dea7..891162467 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/KeyPairResourceStoreStatements.java
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/KeyPairResourceStoreStatements.java
@@ -32,7 +32,7 @@ default String getIdColumn() {
     }
 
     default String getParticipantIdColumn() {
-        return "participant_id";
+        return "participant_context_id";
     }
 
     default String getTimestampColumn() {
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStore.java b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStore.java
index 42b36d898..7776da72a 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStore.java
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStore.java
@@ -16,7 +16,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.spi.persistence.EdcPersistenceException;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.StoreResult;
@@ -55,7 +55,7 @@ public StoreResult<Void> create(KeyPairResource keyPairResource) {
                 }
                 var stmt = statements.getInsertTemplate();
                 queryExecutor.execute(connection, stmt, keyPairResource.getId(),
-                        keyPairResource.getParticipantId(),
+                        keyPairResource.getParticipantContextId(),
                         keyPairResource.getTimestamp(),
                         keyPairResource.getKeyId(),
                         keyPairResource.getGroupName(),
@@ -99,7 +99,7 @@ public StoreResult<Void> update(KeyPairResource keyPairResource) {
 
                 var updateStmt = statements.getUpdateTemplate();
                 queryExecutor.execute(connection, updateStmt, id,
-                        keyPairResource.getParticipantId(),
+                        keyPairResource.getParticipantContextId(),
                         keyPairResource.getTimestamp(),
                         keyPairResource.getKeyId(),
                         keyPairResource.getGroupName(),
@@ -148,7 +148,7 @@ private KeyPairResource mapResultSet(ResultSet resultSet) throws Exception {
 
         return KeyPairResource.Builder.newInstance()
                 .id(resultSet.getString(statements.getIdColumn()))
-                .participantId(resultSet.getString(statements.getParticipantIdColumn()))
+                .participantContextId(resultSet.getString(statements.getParticipantIdColumn()))
                 .timestamp(resultSet.getLong(statements.getTimestampColumn()))
                 .keyId(resultSet.getString(statements.getKeyIdColumn()))
                 .groupName(resultSet.getString(statements.getGroupNameColumn()))
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreExtension.java b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreExtension.java
index 3b45c80d1..9eb350b27 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreExtension.java
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreExtension.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.store.sql.keypair;
 
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.store.sql.keypair.schema.postgres.PostgresDialectStatements;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/schema/postgres/KeyPairResourceMapping.java b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/schema/postgres/KeyPairResourceMapping.java
index 9448f19b3..156ed662e 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/schema/postgres/KeyPairResourceMapping.java
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/keypair/schema/postgres/KeyPairResourceMapping.java
@@ -20,7 +20,7 @@
 public class KeyPairResourceMapping extends TranslationMapping {
     public KeyPairResourceMapping(BaseSqlDialectStatements stmt) {
         add("id", stmt.getIdColumn());
-        add("participantId", stmt.getParticipantIdColumn());
+        add("participantContextId", stmt.getParticipantIdColumn());
         add("timestamp", stmt.getTimestampColumn());
         add("keyId", stmt.getKeyIdColumn());
         add("groupName", stmt.getGroupNameColumn());
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/resources/keypairs-schema.sql b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/resources/keypairs-schema.sql
index e1ce0d4a6..a46aa88a2 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/main/resources/keypairs-schema.sql
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/main/resources/keypairs-schema.sql
@@ -16,7 +16,7 @@
 CREATE TABLE IF NOT EXISTS keypair_resource
 (
     id                    VARCHAR PRIMARY KEY NOT NULL,               -- primary key
-    participant_id        VARCHAR,                                    -- ID of the owning ParticipantContext. this is a loose business key, not a FK!
+    participant_context_id        VARCHAR,                                    -- ID of the owning ParticipantContext. this is a loose business key, not a FK!
     timestamp             BIGINT              NOT NULL,               -- creation timestamp
     key_id                VARCHAR             NOT NULL,               -- name/key-id of this key pair. for use in JWTs etc.
     group_name            VARCHAR,
diff --git a/extensions/store/sql/identity-hub-keypair-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreTest.java b/extensions/store/sql/identity-hub-keypair-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreTest.java
index 92639cd84..94ed727c7 100644
--- a/extensions/store/sql/identity-hub-keypair-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreTest.java
+++ b/extensions/store/sql/identity-hub-keypair-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/keypair/SqlKeyPairResourceStoreTest.java
@@ -14,9 +14,9 @@
 
 package org.eclipse.edc.identityhub.store.sql.keypair;
 
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
+import org.eclipse.edc.identityhub.keypair.store.KeyPairResourceStoreTestBase;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.store.sql.keypair.schema.postgres.PostgresDialectStatements;
-import org.eclipse.edc.identityhub.store.test.KeyPairResourceStoreTestBase;
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.junit.annotations.ComponentTest;
 import org.eclipse.edc.junit.testfixtures.TestUtils;
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/build.gradle.kts b/extensions/store/sql/identity-hub-participantcontext-store-sql/build.gradle.kts
index a3ecac430..f92109445 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/build.gradle.kts
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/build.gradle.kts
@@ -17,12 +17,12 @@ plugins {
 }
 
 dependencies {
-    api(project(":spi:identity-hub-store-spi"))
+    api(project(":spi:participant-context-spi"))
     implementation(libs.edc.lib.sql)
     implementation(libs.edc.sql.bootstrapper)
     implementation(libs.edc.spi.transaction.datasource)
 
-    testImplementation(testFixtures(project(":spi:identity-hub-store-spi")))
+    testImplementation(testFixtures(project(":spi:participant-context-spi")))
     testImplementation(testFixtures(libs.edc.sql.test.fixtures))
     testImplementation(libs.edc.junit)
 }
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/ParticipantContextStoreStatements.java b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/ParticipantContextStoreStatements.java
index ceca59fb8..752b9987a 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/ParticipantContextStoreStatements.java
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/ParticipantContextStoreStatements.java
@@ -28,7 +28,7 @@ default String getParticipantContextTable() {
     }
 
     default String getIdColumn() {
-        return "participant_id";
+        return "participant_context_id";
     }
 
     default String getCreateTimestampColumn() {
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStore.java b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStore.java
index 7ec34cdac..bd12e0cfc 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStore.java
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStore.java
@@ -18,7 +18,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContextState;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.spi.persistence.EdcPersistenceException;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.StoreResult;
@@ -59,7 +59,7 @@ public SqlParticipantContextStore(DataSourceRegistry dataSourceRegistry,
 
     @Override
     public StoreResult<Void> create(ParticipantContext participantContext) {
-        var id = participantContext.getParticipantId();
+        var id = participantContext.getParticipantContextId();
         return transactionContext.execute(() -> {
             try (var connection = getConnection()) {
                 if (findByIdInternal(connection, id) != null) {
@@ -68,7 +68,7 @@ public StoreResult<Void> create(ParticipantContext participantContext) {
 
                 var stmt = statements.getInsertTemplate();
                 queryExecutor.execute(connection, stmt,
-                        participantContext.getParticipantId(),
+                        participantContext.getParticipantContextId(),
                         participantContext.getCreatedAt(),
                         participantContext.getLastModified(),
                         participantContext.getState(),
@@ -98,7 +98,7 @@ public StoreResult<Collection<ParticipantContext>> query(QuerySpec querySpec) {
 
     @Override
     public StoreResult<Void> update(ParticipantContext participantContext) {
-        var id = participantContext.getParticipantId();
+        var id = participantContext.getParticipantContextId();
 
         Objects.requireNonNull(participantContext);
         Objects.requireNonNull(id);
@@ -159,7 +159,7 @@ private ParticipantContext mapResultSet(ResultSet resultSet) throws Exception {
         var roles = fromJson(resultSet.getString(statements.getRolesRolumn()), LIST_REF);
 
         return ParticipantContext.Builder.newInstance()
-                .participantId(id)
+                .participantContextId(id)
                 .createdAt(created)
                 .lastModified(lastmodified)
                 .state(ParticipantContextState.values()[state])
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStoreExtension.java b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStoreExtension.java
index 61b2a95f0..6abdf1750 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStoreExtension.java
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/SqlParticipantContextStoreExtension.java
@@ -14,7 +14,7 @@
 
 package org.eclipse.edc.identityhub.store.sql.participantcontext;
 
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.identityhub.store.sql.participantcontext.schema.postgres.PostgresDialectStatements;
 import org.eclipse.edc.runtime.metamodel.annotation.Extension;
 import org.eclipse.edc.runtime.metamodel.annotation.Inject;
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/schema/postgres/ParticipantContextMapping.java b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/schema/postgres/ParticipantContextMapping.java
index 0c9811db5..0f4f928ad 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/schema/postgres/ParticipantContextMapping.java
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/java/org/eclipse/edc/identityhub/store/sql/participantcontext/schema/postgres/ParticipantContextMapping.java
@@ -14,17 +14,16 @@
 
 package org.eclipse.edc.identityhub.store.sql.participantcontext.schema.postgres;
 
-import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
 import org.eclipse.edc.identityhub.store.sql.participantcontext.ParticipantContextStoreStatements;
 import org.eclipse.edc.sql.translation.TranslationMapping;
 
 
 /**
- * Provides a mapping from the canonical format to SQL column names for a {@link VerifiableCredentialResource}
+ * Provides a mapping from the canonical format to SQL column names for a {@code VerifiableCredentialResource}
  */
 public class ParticipantContextMapping extends TranslationMapping {
 
-    public static final String FIELD_ID = "participantId";
+    public static final String FIELD_ID = "participantContextId";
     public static final String FIELD_CREATE_TIMESTAMP = "createdAt";
     public static final String FIELD_LASTMODIFIED_TIMESTAMP = "lastModified";
     public static final String FIELD_STATE = "state";
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/resources/participant-schema.sql b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/resources/participant-schema.sql
index 5522e3e4f..1cbd3c86b 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/resources/participant-schema.sql
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/main/resources/participant-schema.sql
@@ -15,7 +15,7 @@
 -- only intended for and tested with Postgres!
 CREATE TABLE IF NOT EXISTS participant_context
 (
-    participant_id     VARCHAR PRIMARY KEY NOT NULL, -- ID of the ParticipantContext
+    participant_context_id     VARCHAR PRIMARY KEY NOT NULL, -- ID of the ParticipantContext
     created_date       BIGINT              NOT NULL, -- POSIX timestamp of the creation of the PC
     last_modified_date BIGINT,                       -- POSIX timestamp of the last modified date
     state              INTEGER             NOT NULL, -- 0 = CREATED, 1 = ACTIVE, 2 = DEACTIVATED
@@ -23,5 +23,5 @@ CREATE TABLE IF NOT EXISTS participant_context
     did                VARCHAR,                      -- the DID with which this participant is identified
     roles              JSON                          -- JSON array containing all the roles a user has. may be empty
 );
-CREATE UNIQUE INDEX IF NOT EXISTS participant_context_participant_id_uindex ON participant_context USING btree (participant_id);
+CREATE UNIQUE INDEX IF NOT EXISTS participant_context_participant_context_id_uindex ON participant_context USING btree (participant_context_id);
 
diff --git a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlParticipantContextStoreTest.java b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlParticipantContextStoreTest.java
index 0d2c4f392..f0ef6831d 100644
--- a/extensions/store/sql/identity-hub-participantcontext-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlParticipantContextStoreTest.java
+++ b/extensions/store/sql/identity-hub-participantcontext-store-sql/src/test/java/org/eclipse/edc/identityhub/store/sql/credentials/SqlParticipantContextStoreTest.java
@@ -14,11 +14,11 @@
 
 package org.eclipse.edc.identityhub.store.sql.credentials;
 
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.participantcontext.store.ParticipantContextStoreTestBase;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.identityhub.store.sql.participantcontext.ParticipantContextStoreStatements;
 import org.eclipse.edc.identityhub.store.sql.participantcontext.SqlParticipantContextStore;
 import org.eclipse.edc.identityhub.store.sql.participantcontext.schema.postgres.PostgresDialectStatements;
-import org.eclipse.edc.identityhub.store.test.ParticipantContextStoreTestBase;
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.junit.annotations.ComponentTest;
 import org.eclipse.edc.junit.testfixtures.TestUtils;
diff --git a/extensions/sts/sts-account-provisioner/src/main/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImpl.java b/extensions/sts/sts-account-provisioner/src/main/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImpl.java
index 36d593154..8806cbc70 100644
--- a/extensions/sts/sts-account-provisioner/src/main/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImpl.java
+++ b/extensions/sts/sts-account-provisioner/src/main/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImpl.java
@@ -64,11 +64,11 @@ public <E extends Event> void on(EventEnvelope<E> event) {
         var payload = event.getPayload();
         ServiceResult<Void> result;
         if (payload instanceof ParticipantContextDeleted deletedEvent) {
-            result = stsAccountService.deleteAccount(deletedEvent.getParticipantId());
+            result = stsAccountService.deleteAccount(deletedEvent.getParticipantContextId());
         } else if (payload instanceof KeyPairRevoked kpe) {
-            result = updateStsClient(kpe.getKeyPairResource(), kpe.getParticipantId(), kpe.getNewKeyDescriptor());
+            result = updateStsClient(kpe.getKeyPairResource(), kpe.getParticipantContextId(), kpe.getNewKeyDescriptor());
         } else if (payload instanceof KeyPairRotated kpr) {
-            result = updateStsClient(kpr.getKeyPairResource(), kpr.getParticipantId(), kpr.getNewKeyDescriptor());
+            result = updateStsClient(kpr.getKeyPairResource(), kpr.getParticipantContextId(), kpr.getNewKeyDescriptor());
         } else {
             result = ServiceResult.badRequest("Received event with unexpected payload type: %s".formatted(payload.getClass()));
         }
diff --git a/extensions/sts/sts-account-provisioner/src/test/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImplTest.java b/extensions/sts/sts-account-provisioner/src/test/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImplTest.java
index 93a7cd4da..9c57c5fd5 100644
--- a/extensions/sts/sts-account-provisioner/src/test/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImplTest.java
+++ b/extensions/sts/sts-account-provisioner/src/test/java/org/eclipse/edc/identityhub/common/provisioner/StsAccountProvisionerImplTest.java
@@ -15,7 +15,7 @@
 package org.eclipse.edc.identityhub.common.provisioner;
 
 import org.eclipse.edc.iam.identitytrust.sts.spi.model.StsAccount;
-import org.eclipse.edc.identithub.spi.did.DidDocumentService;
+import org.eclipse.edc.identityhub.spi.did.DidDocumentService;
 import org.eclipse.edc.identityhub.spi.keypair.KeyPairService;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRevoked;
 import org.eclipse.edc.identityhub.spi.keypair.events.KeyPairRotated;
@@ -108,7 +108,7 @@ void onKeyRevoked_shouldUpdate() {
         when(accountServiceMock.findById(PARTICIPANT_CONTEXT_ID)).thenReturn(ServiceResult.success(createStsClient().build()));
         when(accountServiceMock.updateAccount(any())).thenAnswer(a -> ServiceResult.success(a.getArguments()[0]));
         accountProvisioner.on(event(KeyPairRevoked.Builder.newInstance()
-                .participantId(PARTICIPANT_CONTEXT_ID)
+                .participantContextId(PARTICIPANT_CONTEXT_ID)
                 .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
                 .keyId(KEY_ID)
                 .build()));
@@ -124,7 +124,7 @@ void onKeyRotated_withNewKey_shouldUpdate() {
         when(accountServiceMock.updateAccount(any())).thenAnswer(a -> ServiceResult.success(a.getArguments()[0]));
 
         accountProvisioner.on(event(KeyPairRotated.Builder.newInstance()
-                .participantId(PARTICIPANT_CONTEXT_ID)
+                .participantContextId(PARTICIPANT_CONTEXT_ID)
                 .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
                 .keyId(KEY_ID)
                 .build()));
@@ -138,7 +138,7 @@ void onKeyRotated_withNewKey_shouldUpdate() {
     void onParticipantDeleted_shouldDelete() {
         when(accountServiceMock.deleteAccount(PARTICIPANT_CONTEXT_ID)).thenReturn(ServiceResult.success());
         accountProvisioner.on(event(ParticipantContextDeleted.Builder.newInstance()
-                .participantId(PARTICIPANT_CONTEXT_ID)
+                .participantContextId(PARTICIPANT_CONTEXT_ID)
                 .build()));
 
         verify(accountServiceMock).deleteAccount(PARTICIPANT_CONTEXT_ID);
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index cab9d33f3..e4b426c6e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -76,7 +76,6 @@ edc-sql-ih-stsstore-sql = { module = "org.eclipse.edc:sts-client-store-sql", ver
 edc-sql-jtivdalidation = { module = "org.eclipse.edc:jti-validation-store-sql", version.ref = "edc" }
 edc-sql-pool = { module = "org.eclipse.edc:sql-pool-apache-commons", version.ref = "edc" }
 edc-sql-test-fixtures = { module = "org.eclipse.edc:sql-test-fixtures", version.ref = "edc" }
-edc-sql-transactionlocal = { module = "org.eclipse.edc:transaction-local", version.ref = "edc" }
 
 # EDC STS dependencies
 edc-sts-spi = { module = "org.eclipse.edc:identity-trust-sts-spi", version.ref = "edc" }
diff --git a/settings.gradle.kts b/settings.gradle.kts
index b6ff9ab8e..6bbe78816 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -27,11 +27,10 @@ include(":spi:identity-hub-spi")
 include(":spi:participant-context-spi")
 include(":spi:verifiable-credential-spi")
 include(":spi:keypair-spi")
-include(":spi:identity-hub-store-spi")
 include(":spi:did-spi")
 
 // core modules
-include(":core:presentation-api")
+
 include(":core:identity-hub-core")
 include(":core:identity-hub-participants")
 include(":core:identity-hub-keypairs")
@@ -41,9 +40,9 @@ include(":core:identity-hub-did")
 include(":core:lib:verifiable-presentation-lib")
 include(":core:lib:keypair-lib")
 include(":core:lib:accesstoken-lib")
-include(":core:lib:credential-query-lib")
 
 // extension modules
+include(":extensions:protocols:dcp:presentation-api")
 include(":extensions:store:sql:identity-hub-did-store-sql")
 include(":extensions:store:sql:identity-hub-credentials-store-sql")
 include(":extensions:store:sql:identity-hub-participantcontext-store-sql")
@@ -63,6 +62,10 @@ include(":extensions:api:identity-api:participant-context-api")
 include(":extensions:api:identity-api:verifiable-credentials-api")
 include(":extensions:api:identity-api:did-api")
 include(":extensions:api:identity-api:keypair-api")
+// Identity API validators
+include(":extensions:api:identity-api:validators:keypair-validators")
+include(":extensions:api:identity-api:validators:participant-context-validators")
+include(":extensions:api:identity-api:validators:verifiable-credential-validators")
 
 // other modules
 include(":launcher:identityhub")
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidConstants.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidConstants.java
similarity index 95%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidConstants.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidConstants.java
index 6efff409a..ee7cfd4e4 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidConstants.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidConstants.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import java.util.regex.Pattern;
 
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisher.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisher.java
similarity index 97%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisher.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisher.java
index 528f1bf4a..afcd473d1 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisher.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisher.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.runtime.metamodel.annotation.ExtensionPoint;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisherRegistry.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisherRegistry.java
similarity index 96%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisherRegistry.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisherRegistry.java
index 40c870076..2682a2386 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentPublisherRegistry.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentPublisherRegistry.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 /**
  * Registry that hosts multiple {@link DidDocumentPublisher}s to dispatch the publishing of a DID document based on
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentService.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentService.java
similarity index 97%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentService.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentService.java
index d7f3d103a..bc8908a85 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidDocumentService.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidDocumentService.java
@@ -12,11 +12,11 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.ServiceResult;
 
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidWebParser.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidWebParser.java
similarity index 98%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidWebParser.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidWebParser.java
index 0a5ff5bd3..2d9ac05e0 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/DidWebParser.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/DidWebParser.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import org.eclipse.edc.runtime.metamodel.annotation.ExtensionPoint;
 import org.jetbrains.annotations.NotNull;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentEvent.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentEvent.java
similarity index 75%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentEvent.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentEvent.java
index 0efcc5798..f07117099 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentEvent.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentEvent.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import org.eclipse.edc.spi.event.Event;
 
@@ -23,14 +23,14 @@
  */
 public abstract class DidDocumentEvent extends Event {
     protected String did;
-    protected String participantId;
+    protected String participantContextId;
 
     public String getDid() {
         return did;
     }
 
-    public String getParticipantId() {
-        return participantId;
+    public String getParticipantContextId() {
+        return participantContextId;
     }
 
     public abstract static class Builder<T extends DidDocumentEvent, B extends DidDocumentEvent.Builder<T, B>> {
@@ -43,8 +43,8 @@ protected Builder(T event) {
 
         public abstract B self();
 
-        public B participantId(String assetId) {
-            event.participantId = assetId;
+        public B participantContextId(String participantContextId) {
+            event.participantContextId = participantContextId;
             return self();
         }
 
@@ -54,7 +54,7 @@ public B did(String did) {
         }
 
         public T build() {
-            Objects.requireNonNull((event.participantId));
+            Objects.requireNonNull((event.participantContextId));
             return event;
         }
     }
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentListener.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentListener.java
similarity index 95%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentListener.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentListener.java
index a17946cb6..d04e3f97e 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentListener.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentListener.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.spi.observe.Observable;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentObservable.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentObservable.java
similarity index 92%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentObservable.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentObservable.java
index 67a6d52ea..e5d1eb365 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentObservable.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentObservable.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import org.eclipse.edc.spi.observe.Observable;
 
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublished.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublished.java
similarity index 96%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublished.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublished.java
index d4e93fc71..11467864f 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublished.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublished.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublished.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublished.java
similarity index 96%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublished.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublished.java
index 5de89d923..7cfb34113 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublished.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublished.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidResource.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidResource.java
similarity index 98%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidResource.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidResource.java
index c9c3ad2cd..c824f762a 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidResource.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidResource.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.model;
+package org.eclipse.edc.identityhub.spi.did.model;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidState.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidState.java
similarity index 96%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidState.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidState.java
index 38c0c148d..2ce8ae587 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/model/DidState.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/model/DidState.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.model;
+package org.eclipse.edc.identityhub.spi.did.model;
 
 import java.util.Arrays;
 
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/package-info.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/package-info.java
similarity index 93%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/package-info.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/package-info.java
index f2a5c6cf7..ddb680856 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/package-info.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/package-info.java
@@ -18,6 +18,6 @@
  * DID documents.
  */
 @Spi(value = "Identity Hub DID services")
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import org.eclipse.edc.runtime.metamodel.annotation.Spi;
diff --git a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/store/DidResourceStore.java b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/store/DidResourceStore.java
similarity index 96%
rename from spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/store/DidResourceStore.java
rename to spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/store/DidResourceStore.java
index ee6219f12..3e4f26e6d 100644
--- a/spi/did-spi/src/main/java/org/eclipse/edc/identithub/spi/did/store/DidResourceStore.java
+++ b/spi/did-spi/src/main/java/org/eclipse/edc/identityhub/spi/did/store/DidResourceStore.java
@@ -12,9 +12,9 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.store;
+package org.eclipse.edc.identityhub.spi.did.store;
 
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
 import org.eclipse.edc.runtime.metamodel.annotation.ExtensionPoint;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.eclipse.edc.spi.result.StoreResult;
diff --git a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/DidWebParserTest.java b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/DidWebParserTest.java
similarity index 98%
rename from spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/DidWebParserTest.java
rename to spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/DidWebParserTest.java
index 10fde01e4..4e4a4351a 100644
--- a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/DidWebParserTest.java
+++ b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/DidWebParserTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did;
+package org.eclipse.edc.identityhub.spi.did;
 
 import org.junit.jupiter.api.Test;
 
diff --git a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublishedTest.java b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublishedTest.java
similarity index 91%
rename from spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublishedTest.java
rename to spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublishedTest.java
index c999ce93a..e2d407026 100644
--- a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentPublishedTest.java
+++ b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentPublishedTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.spi.types.TypeManager;
@@ -30,7 +30,7 @@ void verify_serDes() {
 
         var event = DidDocumentPublished.Builder.newInstance()
                 .did("did:web:test")
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .build();
 
         var json = manager.writeValueAsString(event);
diff --git a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublishedTest.java b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublishedTest.java
similarity index 91%
rename from spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublishedTest.java
rename to spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublishedTest.java
index 9f426e4f9..98f585d15 100644
--- a/spi/did-spi/src/test/java/org/eclipse/edc/identithub/spi/did/events/DidDocumentUnpublishedTest.java
+++ b/spi/did-spi/src/test/java/org/eclipse/edc/identityhub/spi/did/events/DidDocumentUnpublishedTest.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identithub.spi.did.events;
+package org.eclipse.edc.identityhub.spi.did.events;
 
 import org.eclipse.edc.json.JacksonTypeManager;
 import org.eclipse.edc.spi.types.TypeManager;
@@ -30,7 +30,7 @@ void verify_serDes() {
 
         var event = DidDocumentUnpublished.Builder.newInstance()
                 .did("did:web:test")
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .build();
 
         var json = manager.writeValueAsString(event);
diff --git a/spi/did-spi/src/testFixtures/java/org/eclipse/edc/identityhub/did/store/test/DidResourceStoreTestBase.java b/spi/did-spi/src/testFixtures/java/org/eclipse/edc/identityhub/did/store/test/DidResourceStoreTestBase.java
index 4c8dd3ebc..e614cdbc1 100644
--- a/spi/did-spi/src/testFixtures/java/org/eclipse/edc/identityhub/did/store/test/DidResourceStoreTestBase.java
+++ b/spi/did-spi/src/testFixtures/java/org/eclipse/edc/identityhub/did/store/test/DidResourceStoreTestBase.java
@@ -18,9 +18,9 @@
 import org.eclipse.edc.iam.did.spi.document.DidDocument;
 import org.eclipse.edc.iam.did.spi.document.Service;
 import org.eclipse.edc.iam.did.spi.document.VerificationMethod;
-import org.eclipse.edc.identithub.spi.did.model.DidResource;
-import org.eclipse.edc.identithub.spi.did.model.DidState;
-import org.eclipse.edc.identithub.spi.did.store.DidResourceStore;
+import org.eclipse.edc.identityhub.spi.did.model.DidResource;
+import org.eclipse.edc.identityhub.spi.did.model.DidState;
+import org.eclipse.edc.identityhub.spi.did.store.DidResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
 import org.eclipse.edc.spi.message.Range;
 import org.eclipse.edc.spi.query.Criterion;
@@ -155,11 +155,11 @@ void query_byParticipantId() {
                 .mapToObj(i -> createDidResource(DID + i).build())
                 .toList());
 
-        var expected = createDidResource(DID + "69").participantId("the-odd-one-out").build();
+        var expected = createDidResource(DID + "69").participantContextId("the-odd-one-out").build();
         dids.add(expected);
         dids.forEach(getStore()::save);
 
-        var q = ParticipantResource.queryByParticipantId(expected.getParticipantId()).build();
+        var q = ParticipantResource.queryByParticipantContextId(expected.getParticipantContextId()).build();
         Assertions.assertThat(getStore().query(q))
                 .hasSize(1)
                 .usingRecursiveFieldByFieldElementComparator()
@@ -279,7 +279,7 @@ void deleteById_notExist() {
     private DidResource.Builder createDidResource(String did) {
         return DidResource.Builder.newInstance()
                 .did(did)
-                .participantId("test-participant")
+                .participantContextId("test-participant")
                 .document(DidDocument.Builder.newInstance()
                         .id(did)
                         .build())
diff --git a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationResultHandler.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationResultHandler.java
similarity index 96%
rename from spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationResultHandler.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationResultHandler.java
index 75b5a958f..0c817439b 100644
--- a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationResultHandler.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationResultHandler.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi;
+package org.eclipse.edc.identityhub.spi.authorization;
 
 import org.eclipse.edc.spi.EdcException;
 import org.eclipse.edc.spi.result.ServiceFailure;
diff --git a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationService.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationService.java
similarity index 97%
rename from spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationService.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationService.java
index 7969c7291..7a5e26984 100644
--- a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/AuthorizationService.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/authorization/AuthorizationService.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi;
+package org.eclipse.edc.identityhub.spi.authorization;
 
 import jakarta.ws.rs.core.SecurityContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
diff --git a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/ScopeToCriterionTransformer.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/transformation/ScopeToCriterionTransformer.java
similarity index 95%
rename from spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/ScopeToCriterionTransformer.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/transformation/ScopeToCriterionTransformer.java
index 63933417f..75980c52a 100644
--- a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/ScopeToCriterionTransformer.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/transformation/ScopeToCriterionTransformer.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi;
+package org.eclipse.edc.identityhub.spi.transformation;
 
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.result.Result;
diff --git a/core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenConstants.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenConstants.java
similarity index 72%
rename from core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenConstants.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenConstants.java
index 7293e2600..78a912dfe 100644
--- a/core/lib/accesstoken-lib/src/main/java/org/eclipse/edc/identityhub/accesstoken/verification/AccessTokenConstants.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenConstants.java
@@ -8,13 +8,13 @@
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Contributors:
- *       Metaform Systems, Inc. - initial API and implementation
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
  *
  */
 
-package org.eclipse.edc.identityhub.accesstoken.verification;
+package org.eclipse.edc.identityhub.spi.verification;
 
-public interface AccessTokenConstants {
+public interface SelfIssuedTokenConstants {
     String DCP_SELF_ISSUED_TOKEN_CONTEXT = "dcp-si";
     String DCP_ACCESS_TOKEN_CONTEXT = "dcp-access-token";
     String TOKEN_CLAIM = "token";
diff --git a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/AccessTokenVerifier.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenVerifier.java
similarity index 97%
rename from spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/AccessTokenVerifier.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenVerifier.java
index 0995ada57..f8d36a883 100644
--- a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/AccessTokenVerifier.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/verification/SelfIssuedTokenVerifier.java
@@ -22,7 +22,7 @@
 /**
  * The AccessTokenVerifier interface represents a verifier for Self-Issued JWT tokens. It takes a base64-encoded ID token.
  */
-public interface AccessTokenVerifier {
+public interface SelfIssuedTokenVerifier {
     /**
      * Performs the verification on a self-issued ID token, asserting the following aspects:
      * <ul>
diff --git a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/IdentityHubApiContext.java b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/webcontext/IdentityHubApiContext.java
similarity index 92%
rename from spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/IdentityHubApiContext.java
rename to spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/webcontext/IdentityHubApiContext.java
index fcd609b56..14af86fb8 100644
--- a/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/IdentityHubApiContext.java
+++ b/spi/identity-hub-spi/src/main/java/org/eclipse/edc/identityhub/spi/webcontext/IdentityHubApiContext.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi;
+package org.eclipse.edc.identityhub.spi.webcontext;
 
 public interface IdentityHubApiContext {
     String IDENTITY = "identity";
diff --git a/spi/identity-hub-store-spi/build.gradle.kts b/spi/identity-hub-store-spi/build.gradle.kts
deleted file mode 100644
index 212ad2fbe..000000000
--- a/spi/identity-hub-store-spi/build.gradle.kts
+++ /dev/null
@@ -1,20 +0,0 @@
-plugins {
-    `java-library`
-    `java-test-fixtures`
-    `maven-publish`
-}
-
-dependencies {
-    api(project(":spi:identity-hub-spi"))
-    api(project(":spi:participant-context-spi"))
-    api(project(":spi:verifiable-credential-spi"))
-    api(project(":spi:keypair-spi"))
-    api(libs.edc.spi.core)
-
-    testFixturesImplementation(testFixtures(project(":spi:identity-hub-spi")))
-    testFixturesImplementation(libs.edc.junit)
-    testFixturesImplementation(libs.junit.jupiter.api)
-    testFixturesImplementation(libs.assertj)
-    testFixturesImplementation(libs.nimbus.jwt)
-    testFixturesImplementation(libs.jackson.databind)
-}
diff --git a/spi/keypair-spi/build.gradle.kts b/spi/keypair-spi/build.gradle.kts
index 48823ec8d..2c79c0e0f 100644
--- a/spi/keypair-spi/build.gradle.kts
+++ b/spi/keypair-spi/build.gradle.kts
@@ -14,15 +14,17 @@
 
 plugins {
     `java-library`
+    `java-test-fixtures`
     `maven-publish`
 }
 
-val swagger: String by project
-
 dependencies {
 
     api(project(":spi:participant-context-spi"))
     api(libs.edc.spi.core)
 
     testImplementation(libs.edc.lib.json)
+    testFixturesImplementation(libs.edc.junit)
+    testFixturesImplementation(libs.junit.jupiter.api)
+    testFixturesImplementation(libs.assertj)
 }
diff --git a/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/KeyPairService.java b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/KeyPairService.java
index 142e86307..b34736dba 100644
--- a/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/KeyPairService.java
+++ b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/KeyPairService.java
@@ -29,12 +29,12 @@ public interface KeyPairService {
     /**
      * Adds a new key pair to a participant and optionally makes it the default key pair. (Database) IDs are assigned automatically, by default using a GUID.
      *
-     * @param participantId The participant ID to which the new key pair is supposed to belong.
-     * @param keyDescriptor Contains either the new key in serialized form, or instructions how to generate it.
-     * @param makeDefault   Whether this new key is supposed to be the default key for the participant.
+     * @param participantContextId The participant context ID to which the new key pair is supposed to belong.
+     * @param keyDescriptor        Contains either the new key in serialized form, or instructions how to generate it.
+     * @param makeDefault          Whether this new key is supposed to be the default key for the participant.
      * @return a failure if the new key could not get created, success otherwise
      */
-    ServiceResult<Void> addKeyPair(String participantId, KeyDescriptor keyDescriptor, boolean makeDefault);
+    ServiceResult<Void> addKeyPair(String participantContextId, KeyDescriptor keyDescriptor, boolean makeDefault);
 
     /**
      * Phases out an old key and creates a new one. The old key pair's private key gets deleted from the vault, so it cannot be used
diff --git a/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairEvent.java b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairEvent.java
index 0c8447bf3..0e8645cec 100644
--- a/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairEvent.java
+++ b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairEvent.java
@@ -24,7 +24,7 @@
  * Base class for all events that relate to state changes or actions regarding KeyPairs
  */
 public abstract class KeyPairEvent extends Event {
-    protected String participantId;
+    protected String participantContextId;
     protected KeyPairResource keyPairResource;
     protected String keyId;
 
@@ -45,8 +45,8 @@ public String getKeyId() {
     /**
      * The ID of the {@link ParticipantContext} that owns the KeyPair resource.
      */
-    public String getParticipantId() {
-        return participantId;
+    public String getParticipantContextId() {
+        return participantContextId;
     }
 
     public abstract static class Builder<T extends KeyPairEvent, B extends KeyPairEvent.Builder<T, B>> {
@@ -59,8 +59,8 @@ protected Builder(T event) {
 
         public abstract B self();
 
-        public B participantId(String assetId) {
-            event.participantId = assetId;
+        public B participantContextId(String participantContextId) {
+            event.participantContextId = participantContextId;
             return self();
         }
 
@@ -75,7 +75,7 @@ public B keyPairResource(KeyPairResource keyPairResource) {
         }
 
         public T build() {
-            Objects.requireNonNull((event.participantId));
+            Objects.requireNonNull((event.participantContextId));
             return event;
         }
     }
diff --git a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/KeyPairResourceStore.java b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/store/KeyPairResourceStore.java
similarity index 97%
rename from spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/KeyPairResourceStore.java
rename to spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/store/KeyPairResourceStore.java
index 89b925de4..1f80930b4 100644
--- a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/KeyPairResourceStore.java
+++ b/spi/keypair-spi/src/main/java/org/eclipse/edc/identityhub/spi/keypair/store/KeyPairResourceStore.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi.store;
+package org.eclipse.edc.identityhub.spi.keypair.store;
 
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.spi.query.QuerySpec;
diff --git a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairAddedTest.java b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairAddedTest.java
index 22923895f..b2f89c886 100644
--- a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairAddedTest.java
+++ b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairAddedTest.java
@@ -32,7 +32,7 @@ void verify_serDes() {
         var evt = KeyPairAdded.Builder.newInstance()
                 .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
                 .keyId("key-id")
-                .participantId("participant-id")
+                .participantContextId("participant-id")
                 .build();
 
         var json = typeManager.writeValueAsString(evt);
diff --git a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRevokedTest.java b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRevokedTest.java
index 4141172bc..808d54bb4 100644
--- a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRevokedTest.java
+++ b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRevokedTest.java
@@ -32,7 +32,7 @@ void verify_serDes() {
         var evt = KeyPairRevoked.Builder.newInstance()
                 .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
                 .keyId("key-id")
-                .participantId("participant-id")
+                .participantContextId("participant-id")
                 .build();
 
         var json = typeManager.writeValueAsString(evt);
diff --git a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRotatedTest.java b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRotatedTest.java
index 85df2c99c..34997bc52 100644
--- a/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRotatedTest.java
+++ b/spi/keypair-spi/src/test/java/org/eclipse/edc/identityhub/spi/keypair/events/KeyPairRotatedTest.java
@@ -32,7 +32,7 @@ void verify_serDes() {
         var evt = KeyPairRotated.Builder.newInstance()
                 .keyPairResource(KeyPairResource.Builder.newInstance().id(UUID.randomUUID().toString()).build())
                 .keyId("key-id")
-                .participantId("participant-id")
+                .participantContextId("participant-id")
                 .build();
 
         var json = typeManager.writeValueAsString(evt);
diff --git a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/KeyPairResourceStoreTestBase.java b/spi/keypair-spi/src/testFixtures/java/org/eclipse/edc/identityhub/keypair/store/KeyPairResourceStoreTestBase.java
similarity index 93%
rename from spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/KeyPairResourceStoreTestBase.java
rename to spi/keypair-spi/src/testFixtures/java/org/eclipse/edc/identityhub/keypair/store/KeyPairResourceStoreTestBase.java
index fc4338c85..a9c1ba931 100644
--- a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/KeyPairResourceStoreTestBase.java
+++ b/spi/keypair-spi/src/testFixtures/java/org/eclipse/edc/identityhub/keypair/store/KeyPairResourceStoreTestBase.java
@@ -12,13 +12,13 @@
  *
  */
 
-package org.eclipse.edc.identityhub.store.test;
+package org.eclipse.edc.identityhub.keypair.store;
 
 import org.assertj.core.api.Assertions;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairResource;
 import org.eclipse.edc.identityhub.spi.keypair.model.KeyPairState;
+import org.eclipse.edc.identityhub.spi.keypair.store.KeyPairResourceStore;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.KeyPairResourceStore;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.junit.jupiter.api.Test;
@@ -80,7 +80,7 @@ void query_byProperty() {
     @Test
     void query_noQuerySpec() {
         var resources = range(0, 5)
-                .mapToObj(i -> createKeyPairResource().participantId("id" + i).build())
+                .mapToObj(i -> createKeyPairResource().participantContextId("id" + i).build())
                 .toList();
 
         resources.forEach(getStore()::create);
@@ -96,13 +96,13 @@ void query_noQuerySpec() {
     void query_whenNotFound() {
         var resources = range(0, 5)
                 .mapToObj(i -> createKeyPairResource()
-                        .participantId("id" + i)
+                        .participantContextId("id" + i)
                         .build())
                 .toList();
 
         resources.forEach(getStore()::create);
 
-        var query = ParticipantResource.queryByParticipantId("id7")
+        var query = ParticipantResource.queryByParticipantContextId("id7")
                 .build();
         var res = getStore().query(query);
         assertThat(res).isSucceeded();
@@ -113,7 +113,7 @@ void query_whenNotFound() {
     void query_byInvalidField_shouldReturnEmptyList() {
         var resources = range(0, 5)
                 .mapToObj(i -> createKeyPairResource()
-                        .participantId("id" + i)
+                        .participantContextId("id" + i)
                         .build())
                 .toList();
 
@@ -170,7 +170,7 @@ void update_whenIdChanges_fails() {
     @Test
     void update_whenNotExists() {
         var context = createKeyPairResource();
-        var updateRes = getStore().update(context.state(KeyPairState.ROTATED).participantId("another-id").build());
+        var updateRes = getStore().update(context.state(KeyPairState.ROTATED).participantContextId("another-id").build());
         assertThat(updateRes).isFailed().detail().matches(".* with ID .* does not exist.");
     }
 
@@ -196,7 +196,7 @@ private KeyPairResource.Builder createKeyPairResource() {
                 .id(UUID.randomUUID().toString())
                 .keyId("test-key-1")
                 .privateKeyAlias("private-key-alias")
-                .participantId("test-participant")
+                .participantContextId("test-participant")
                 .serializedPublicKey("this-is-a-pem-string")
                 .keyContext("JsonWebKey2020")
                 .useDuration(Duration.ofDays(6).toMillis());
diff --git a/spi/participant-context-spi/build.gradle.kts b/spi/participant-context-spi/build.gradle.kts
index 988c8b452..3bc3d6a2a 100644
--- a/spi/participant-context-spi/build.gradle.kts
+++ b/spi/participant-context-spi/build.gradle.kts
@@ -24,4 +24,7 @@ dependencies {
     implementation(libs.edc.spi.identity.did) // ParticipantManifest#serviceEndpoint
     implementation(libs.edc.sts.spi) // StsAccount
     testImplementation(libs.edc.lib.json)
+    testFixturesImplementation(libs.edc.junit)
+    testFixturesImplementation(libs.junit.jupiter.api)
+    testFixturesImplementation(libs.assertj)
 }
diff --git a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextId.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextId.java
index 47d24435c..8461708cc 100644
--- a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextId.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextId.java
@@ -27,8 +27,8 @@ private ParticipantContextId() {
     /**
      * Decode a base64-url encoded participantId.
      *
-     * @param encoded base64-url encoded participantId.
-     * @return human-readable participantId.
+     * @param encoded base64-url encoded participantContextId.
+     * @return human-readable participantContextId.
      */
     public static Result<String> onEncoded(String encoded) {
         var bytes = Base64.getUrlDecoder().decode(encoded.getBytes());
diff --git a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextService.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextService.java
index c5c745106..8ea7add03 100644
--- a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextService.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/ParticipantContextService.java
@@ -39,37 +39,37 @@ public interface ParticipantContextService {
     /**
      * Fetches the {@link ParticipantContext} by ID.
      *
-     * @param participantId the ID to look for.
+     * @param participantContextId the ID to look for.
      * @return The participant context, or a failure if not found.
      */
-    ServiceResult<ParticipantContext> getParticipantContext(String participantId);
+    ServiceResult<ParticipantContext> getParticipantContext(String participantContextId);
 
     /**
      * Deletes the {@link ParticipantContext} by ID.
      *
-     * @param participantId the ID to delete.
+     * @param participantContextId the ID to delete.
      * @return Success if deleted, or a failure if not found.
      */
-    ServiceResult<Void> deleteParticipantContext(String participantId);
+    ServiceResult<Void> deleteParticipantContext(String participantContextId);
 
     /**
      * Re-generates the API token for a particular participant context. The API token will be overwritten in the vault using
      * the same alias as before.
      * Note that API tokens are <strong>never</strong> stored in the database.
      *
-     * @param participantId The participant ID to regenerate the API token for.
+     * @param participantContextId The participant ID to regenerate the API token for.
      * @return the new API token, or a failure
      */
-    ServiceResult<String> regenerateApiToken(String participantId);
+    ServiceResult<String> regenerateApiToken(String participantContextId);
 
     /**
      * Applies a modification function to the {@link ParticipantContext} and persists the changed object in the database.
      *
-     * @param participantId        The ID of the participant to modify
+     * @param participantContextId The ID of the participant to modify
      * @param modificationFunction A modification function that is applied to the participant context
      * @return success if the update could be performed, a failure otherwise
      */
-    ServiceResult<Void> updateParticipant(String participantId, Consumer<ParticipantContext> modificationFunction);
+    ServiceResult<Void> updateParticipant(String participantContextId, Consumer<ParticipantContext> modificationFunction);
 
     /**
      * Returns a collection of {@link ParticipantContext} objects that match the specified query.
diff --git a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextEvent.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextEvent.java
index 93bd69bc2..1e5957bdc 100644
--- a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextEvent.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextEvent.java
@@ -23,10 +23,10 @@
  * Base class for all events related to state changes and actions of {@link ParticipantContext}s
  */
 public abstract class ParticipantContextEvent extends Event {
-    protected String participantId;
+    protected String participantContextId;
 
-    public String getParticipantId() {
-        return participantId;
+    public String getParticipantContextId() {
+        return participantContextId;
     }
 
     public abstract static class Builder<T extends ParticipantContextEvent, B extends ParticipantContextEvent.Builder<T, B>> {
@@ -39,13 +39,13 @@ protected Builder(T event) {
 
         public abstract B self();
 
-        public B participantId(String participantId) {
-            event.participantId = participantId;
+        public B participantContextId(String participantContextId) {
+            event.participantContextId = participantContextId;
             return self();
         }
 
         public T build() {
-            Objects.requireNonNull((event.participantId));
+            Objects.requireNonNull((event.participantContextId));
             return event;
         }
     }
diff --git a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContext.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContext.java
index 4f09df64e..797c18777 100644
--- a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContext.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContext.java
@@ -135,13 +135,13 @@ public Builder self() {
             return this;
         }
 
-        public Builder participantId(String participantId) {
-            this.entity.participantId = participantId;
+        public Builder participantContextId(String participantContextId) {
+            this.entity.participantContextId = participantContextId;
             return this;
         }
 
         public ParticipantContext build() {
-            Objects.requireNonNull(entity.participantId, "Participant ID cannot be null");
+            Objects.requireNonNull(entity.participantContextId, "Participant ID cannot be null");
             Objects.requireNonNull(entity.apiTokenAlias, "API Token Alias cannot be null");
 
             if (entity.getLastModified() == 0L) {
diff --git a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantResource.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantResource.java
index 04e041f6c..f1f8b9180 100644
--- a/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantResource.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantResource.java
@@ -21,18 +21,18 @@
  * This is the base class for all resources that are owned by a {@link ParticipantContext}.
  */
 public abstract class ParticipantResource {
-    protected String participantId;
+    protected String participantContextId;
 
-    public static QuerySpec.Builder queryByParticipantId(String participantId) {
-        return QuerySpec.Builder.newInstance().filter(new Criterion("participantId", "=", participantId));
+    public static QuerySpec.Builder queryByParticipantContextId(String participantContextId) {
+        return QuerySpec.Builder.newInstance().filter(new Criterion("participantContextId", "=", participantContextId));
     }
 
     /**
      * The {@link ParticipantContext} that this resource belongs to.
      */
 
-    public String getParticipantId() {
-        return participantId;
+    public String getParticipantContextId() {
+        return participantContextId;
     }
 
     public abstract static class Builder<T extends ParticipantResource, B extends ParticipantResource.Builder<T, B>> {
@@ -44,8 +44,8 @@ protected Builder(T entity) {
 
         public abstract B self();
 
-        public B participantId(String participantId) {
-            entity.participantId = participantId;
+        public B participantContextId(String participantContextId) {
+            entity.participantContextId = participantContextId;
             return self();
         }
 
diff --git a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/ParticipantContextStore.java b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/store/ParticipantContextStore.java
similarity index 91%
rename from spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/ParticipantContextStore.java
rename to spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/store/ParticipantContextStore.java
index c6bd50e41..80b776aec 100644
--- a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/ParticipantContextStore.java
+++ b/spi/participant-context-spi/src/main/java/org/eclipse/edc/identityhub/spi/participantcontext/store/ParticipantContextStore.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi.store;
+package org.eclipse.edc.identityhub.spi.participantcontext.store;
 
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
@@ -65,12 +65,12 @@ default String notFoundErrorMessage(String id) {
         return "A ParticipantContext with ID '%s' does not exist.".formatted(id);
     }
 
-    default StoreResult<ParticipantContext> findById(String participantId) {
-        var res = query(ParticipantResource.queryByParticipantId(participantId).build());
+    default StoreResult<ParticipantContext> findById(String participantContextId) {
+        var res = query(ParticipantResource.queryByParticipantContextId(participantContextId).build());
         if (res.succeeded()) {
             return res.getContent().stream().findFirst()
                     .map(StoreResult::success)
-                    .orElse(StoreResult.notFound("ParticipantContext with ID '%s' does not exist.".formatted(participantId)));
+                    .orElse(StoreResult.notFound("ParticipantContext with ID '%s' does not exist.".formatted(participantContextId)));
         }
         return StoreResult.generalError(res.getFailureDetail());
     }
diff --git a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextCreatedTest.java b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextCreatedTest.java
index 263d010d1..aa4eb738e 100644
--- a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextCreatedTest.java
+++ b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextCreatedTest.java
@@ -28,7 +28,7 @@ class ParticipantContextCreatedTest {
     @Test
     void verify_serDes() throws JsonProcessingException {
         var evt = ParticipantContextCreated.Builder.newInstance()
-                .participantId("test-participantId")
+                .participantContextId("test-participantId")
                 .build();
 
         var json = manager.writeValueAsString(evt);
diff --git a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextDeletedTest.java b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextDeletedTest.java
index 6082c24fa..2b3f95d79 100644
--- a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextDeletedTest.java
+++ b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextDeletedTest.java
@@ -28,7 +28,7 @@ class ParticipantContextDeletedTest {
     @Test
     void verify_serDes() throws JsonProcessingException {
         var evt = ParticipantContextDeleted.Builder.newInstance()
-                .participantId("test-participantId")
+                .participantContextId("test-participantId")
                 .build();
 
         var json = manager.writeValueAsString(evt);
diff --git a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextUpdatedTest.java b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextUpdatedTest.java
index e99b2d2b7..b3434b5c3 100644
--- a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextUpdatedTest.java
+++ b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/events/ParticipantContextUpdatedTest.java
@@ -27,7 +27,7 @@ class ParticipantContextUpdatedTest {
     @Test
     void verify_serDes() throws JsonProcessingException {
         var evt = ParticipantContextUpdated.Builder.newInstance()
-                .participantId("test-participantId")
+                .participantContextId("test-participantId")
                 .build();
 
         var json = manager.writeValueAsString(evt);
diff --git a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContextTest.java b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContextTest.java
index 92c7c0210..1000fde18 100644
--- a/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContextTest.java
+++ b/spi/participant-context-spi/src/test/java/org/eclipse/edc/identityhub/spi/participantcontext/model/ParticipantContextTest.java
@@ -25,14 +25,14 @@ class ParticipantContextTest {
     @Test
     void verifyCreateTimestamp() {
         var context = ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .apiTokenAlias("foo-token")
                 .build();
 
         assertThat(context.getCreatedAt()).isNotZero().isLessThanOrEqualTo(Instant.now().toEpochMilli());
 
         var context2 = ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .apiTokenAlias("foo-token")
                 .createdAt(42)
                 .build();
@@ -43,14 +43,14 @@ void verifyCreateTimestamp() {
     @Test
     void verifyLastModifiedTimestamp() {
         var context = ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .apiTokenAlias("foo-token")
                 .build();
 
         assertThat(context.getLastModified()).isNotZero().isEqualTo(context.getCreatedAt());
 
         var context2 = ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .apiTokenAlias("foo-token")
                 .lastModified(42)
                 .build();
@@ -61,7 +61,7 @@ void verifyLastModifiedTimestamp() {
     @Test
     void verifyState() {
         var context = ParticipantContext.Builder.newInstance()
-                .participantId("test-id")
+                .participantContextId("test-id")
                 .apiTokenAlias("foo-token")
                 .state(ParticipantContextState.CREATED);
 
diff --git a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/ParticipantContextStoreTestBase.java b/spi/participant-context-spi/src/testFixtures/java/org/eclipse/edc/identityhub/participantcontext/store/ParticipantContextStoreTestBase.java
similarity index 89%
rename from spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/ParticipantContextStoreTestBase.java
rename to spi/participant-context-spi/src/testFixtures/java/org/eclipse/edc/identityhub/participantcontext/store/ParticipantContextStoreTestBase.java
index b9e86fb7e..62bb36607 100644
--- a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/ParticipantContextStoreTestBase.java
+++ b/spi/participant-context-spi/src/testFixtures/java/org/eclipse/edc/identityhub/participantcontext/store/ParticipantContextStoreTestBase.java
@@ -12,12 +12,12 @@
  *
  */
 
-package org.eclipse.edc.identityhub.store.test;
+package org.eclipse.edc.identityhub.participantcontext.store;
 
 import org.assertj.core.api.Assertions;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantContext;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.ParticipantContextStore;
+import org.eclipse.edc.identityhub.spi.participantcontext.store.ParticipantContextStore;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.junit.jupiter.api.Test;
@@ -55,10 +55,10 @@ void create_whenExists_shouldReturnFailure() {
     @Test
     void query_byId() {
         range(0, 5)
-                .mapToObj(i -> createParticipantContextBuilder().participantId("id" + i).build())
+                .mapToObj(i -> createParticipantContextBuilder().participantContextId("id" + i).build())
                 .forEach(getStore()::create);
 
-        var query = ParticipantResource.queryByParticipantId("id2")
+        var query = ParticipantResource.queryByParticipantContextId("id2")
                 .build();
 
         assertThat(getStore().query(query)).isSucceeded()
@@ -84,7 +84,7 @@ void query_byProperty() {
     @Test
     void query_noQuerySpec() {
         var resources = range(0, 5)
-                .mapToObj(i -> createParticipantContextBuilder().participantId("id" + i).build())
+                .mapToObj(i -> createParticipantContextBuilder().participantContextId("id" + i).build())
                 .toList();
 
         resources.forEach(getStore()::create);
@@ -100,13 +100,13 @@ void query_noQuerySpec() {
     void query_whenNotFound() {
         var resources = range(0, 5)
                 .mapToObj(i -> createParticipantContextBuilder()
-                        .participantId("id" + i)
+                        .participantContextId("id" + i)
                         .build())
                 .toList();
 
         resources.forEach(getStore()::create);
 
-        var query = ParticipantResource.queryByParticipantId("id7")
+        var query = ParticipantResource.queryByParticipantContextId("id7")
                 .build();
         var res = getStore().query(query);
         assertThat(res).isSucceeded();
@@ -117,7 +117,7 @@ void query_whenNotFound() {
     void query_byInvalidField_shouldReturnEmptyList() {
         var resources = range(0, 5)
                 .mapToObj(i -> createParticipantContextBuilder()
-                        .participantId("id" + i)
+                        .participantContextId("id" + i)
                         .build())
                 .toList();
 
@@ -146,14 +146,14 @@ void update_whenIdChanges_fails() {
         var context = createParticipantContextBuilder();
         var result = getStore().create(context.build());
 
-        var updateRes = getStore().update(context.state(DEACTIVATED).participantId("another-id").build());
+        var updateRes = getStore().update(context.state(DEACTIVATED).participantContextId("another-id").build());
         assertThat(updateRes).isFailed().detail().contains("with ID 'another-id' does not exist.");
     }
 
     @Test
     void update_whenNotExists() {
         var context = createParticipantContextBuilder();
-        var updateRes = getStore().update(context.state(DEACTIVATED).participantId("another-id").build());
+        var updateRes = getStore().update(context.state(DEACTIVATED).participantContextId("another-id").build());
         assertThat(updateRes).isFailed().detail().contains("with ID 'another-id' does not exist.");
     }
 
@@ -162,7 +162,7 @@ void delete() {
         var context = createParticipantContext();
         getStore().create(context);
 
-        var deleteRes = getStore().deleteById(context.getParticipantId());
+        var deleteRes = getStore().deleteById(context.getParticipantContextId());
         assertThat(deleteRes).isSucceeded();
     }
 
@@ -176,7 +176,7 @@ void delete_whenNotExists() {
 
     private ParticipantContext createParticipantContext() {
         return ParticipantContext.Builder.newInstance()
-                .participantId("test-participant")
+                .participantContextId("test-participant")
                 .roles(List.of("role1", "role2"))
                 .state(CREATED)
                 .apiTokenAlias("test-alias")
@@ -185,7 +185,7 @@ private ParticipantContext createParticipantContext() {
 
     private ParticipantContext.Builder createParticipantContextBuilder() {
         return ParticipantContext.Builder.newInstance()
-                .participantId("test-participant")
+                .participantContextId("test-participant")
                 .state(CREATED)
                 .roles(List.of("role1", "role2"))
                 .apiTokenAlias("test-alias");
diff --git a/spi/verifiable-credential-spi/build.gradle.kts b/spi/verifiable-credential-spi/build.gradle.kts
index 8a6543092..fb14b4fb9 100644
--- a/spi/verifiable-credential-spi/build.gradle.kts
+++ b/spi/verifiable-credential-spi/build.gradle.kts
@@ -18,14 +18,15 @@ plugins {
     `maven-publish`
 }
 
-val swagger: String by project
-
 dependencies {
 
     api(project(":spi:participant-context-spi"))
     api(libs.edc.spi.dcp)
 
     testImplementation(libs.edc.lib.json)
+    testFixturesImplementation(libs.edc.junit)
+    testFixturesImplementation(libs.junit.jupiter.api)
+    testFixturesImplementation(libs.assertj)
     testFixturesImplementation(libs.nimbus.jwt)
     testFixturesImplementation(libs.edc.spi.identity.did)
     testFixturesImplementation(libs.edc.lib.common.crypto)
diff --git a/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifest.java b/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifest.java
index 0abdf7c56..d0ce80a18 100644
--- a/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifest.java
+++ b/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifest.java
@@ -47,7 +47,7 @@ public String getId() {
     /**
      * The participant id.
      */
-    public String getParticipantId() {
+    public String getParticipantContextId() {
         return participantId;
     }
 
@@ -93,7 +93,7 @@ public Builder id(String id) {
             return this;
         }
 
-        public Builder participantId(String participantId) {
+        public Builder participantContextId(String participantId) {
             manifest.participantId = participantId;
             return this;
         }
diff --git a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/CredentialStore.java b/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/store/CredentialStore.java
similarity index 97%
rename from spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/CredentialStore.java
rename to spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/store/CredentialStore.java
index 3bb89aab1..1b89c65c6 100644
--- a/spi/identity-hub-store-spi/src/main/java/org/eclipse/edc/identityhub/spi/store/CredentialStore.java
+++ b/spi/verifiable-credential-spi/src/main/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/store/CredentialStore.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.spi.store;
+package org.eclipse.edc.identityhub.spi.verifiablecredentials.store;
 
 
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
diff --git a/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifestTest.java b/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifestTest.java
index 7380e1283..ac59da683 100644
--- a/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifestTest.java
+++ b/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialManifestTest.java
@@ -35,7 +35,7 @@ class VerifiableCredentialManifestTest {
     void serDeser() {
         var manifest = VerifiableCredentialManifest.Builder.newInstance()
                 .id("id")
-                .participantId("participantId")
+                .participantContextId("participantId")
                 .verifiableCredentialContainer(new VerifiableCredentialContainer("rawVc", CredentialFormat.JWT, VerifiableCredential.Builder.newInstance()
                         .type("type")
                         .credentialSubject(CredentialSubject.Builder.newInstance().id("id").claim("foo", "bar").build())
diff --git a/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialResourceTest.java b/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialResourceTest.java
index 676f58e2e..287e8fbb4 100644
--- a/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialResourceTest.java
+++ b/spi/verifiable-credential-spi/src/test/java/org/eclipse/edc/identityhub/spi/verifiablecredentials/model/VerifiableCredentialResourceTest.java
@@ -41,7 +41,7 @@ void verifyBuilder_assertDefaultValues() {
         var vc = VerifiableCredentialResource.Builder.newInstance()
                 .issuerId("test-issuer")
                 .holderId("test-holder")
-                .participantId("test-participant")
+                .participantContextId("test-participant")
                 .build();
 
         assertThat(vc.getClock()).isNotNull();
diff --git a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/CredentialStoreTestBase.java b/spi/verifiable-credential-spi/src/testFixtures/java/org/eclipse/edc/identityhub/verifiablecredentials/store/CredentialStoreTestBase.java
similarity index 91%
rename from spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/CredentialStoreTestBase.java
rename to spi/verifiable-credential-spi/src/testFixtures/java/org/eclipse/edc/identityhub/verifiablecredentials/store/CredentialStoreTestBase.java
index 656169633..893c2d9e3 100644
--- a/spi/identity-hub-store-spi/src/testFixtures/java/org/eclipse/edc/identityhub/store/test/CredentialStoreTestBase.java
+++ b/spi/verifiable-credential-spi/src/testFixtures/java/org/eclipse/edc/identityhub/verifiablecredentials/store/CredentialStoreTestBase.java
@@ -12,7 +12,7 @@
  *
  */
 
-package org.eclipse.edc.identityhub.store.test;
+package org.eclipse.edc.identityhub.verifiablecredentials.store;
 
 import org.assertj.core.api.Assertions;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.CredentialFormat;
@@ -21,9 +21,9 @@
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredential;
 import org.eclipse.edc.iam.verifiablecredentials.spi.model.VerifiableCredentialContainer;
 import org.eclipse.edc.identityhub.spi.participantcontext.model.ParticipantResource;
-import org.eclipse.edc.identityhub.spi.store.CredentialStore;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VcStatus;
 import org.eclipse.edc.identityhub.spi.verifiablecredentials.model.VerifiableCredentialResource;
+import org.eclipse.edc.identityhub.spi.verifiablecredentials.store.CredentialStore;
 import org.eclipse.edc.spi.query.Criterion;
 import org.eclipse.edc.spi.query.QuerySpec;
 import org.jetbrains.annotations.NotNull;
@@ -135,11 +135,11 @@ void query_byParticipantId() {
         range(0, 5)
                 .mapToObj(i -> createCredentialBuilder()
                         .id("id" + i)
-                        .participantId("participant" + i)
+                        .participantContextId("participant" + i)
                         .build())
                 .forEach(getStore()::create);
 
-        var query = ParticipantResource.queryByParticipantId("participant2")
+        var query = ParticipantResource.queryByParticipantContextId("participant2")
                 .build();
 
         assertThat(getStore().query(query)).isSucceeded()
@@ -149,16 +149,16 @@ void query_byParticipantId() {
     @Test
     void query_byParticipantIdAndType() {
         var cred1 = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .type("UniversityDegreeCredential")
                         .build()))
-                .participantId(TEST_PARTICIPANT_CONTEXT_ID).build();
-        var cred2 = createCredentialBuilder().participantId("participant-context2").build();
-        var cred3 = createCredentialBuilder().participantId("participant-context3").build();
+                .participantContextId(TEST_PARTICIPANT_CONTEXT_ID).build();
+        var cred2 = createCredentialBuilder().participantContextId("participant-context2").build();
+        var cred3 = createCredentialBuilder().participantContextId("participant-context3").build();
 
         Arrays.asList(cred1, cred2, cred3).forEach(getStore()::create);
 
-        var query = ParticipantResource.queryByParticipantId(TEST_PARTICIPANT_CONTEXT_ID)
+        var query = ParticipantResource.queryByParticipantContextId(TEST_PARTICIPANT_CONTEXT_ID)
                 .filter(new Criterion("verifiableCredential.credential.type", "contains", "UniversityDegreeCredential"))
                 .build();
 
@@ -191,7 +191,7 @@ void query_likeRawVc() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC_WITH_PHD_DEGREE, CredentialFormat.JSON_LD, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC_WITH_PHD_DEGREE, CredentialFormat.VC1_0_LD, createVerifiableCredential().build()))
                 .build();
         creds.add(expectedCred);
         creds.forEach(getStore()::create);
@@ -212,13 +212,13 @@ void query_byVcFormat() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JWT, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_JWT, createVerifiableCredential().build()))
                 .build();
         creds.add(expectedCred);
         creds.forEach(getStore()::create);
 
         var query = QuerySpec.Builder.newInstance()
-                .filter(new Criterion("verifiableCredential.format", "=", CredentialFormat.JWT.ordinal()))
+                .filter(new Criterion("verifiableCredential.format", "=", CredentialFormat.VC1_0_JWT.ordinal()))
                 .build();
 
         assertThat(getStore().query(query)).isSucceeded()
@@ -232,7 +232,7 @@ void query_byJsonProperty_type() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .type("TestType")
                         .build()))
                 .build();
@@ -254,7 +254,7 @@ void query_byJsonProperty_credentialSubject() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .credentialSubject(CredentialSubject.Builder.newInstance()
                                 .claim("degreeType", "PhdDegree")
                                 .build())
@@ -278,7 +278,7 @@ void query_byJsonProperty_credentialSubjectId() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .credentialSubject(CredentialSubject.Builder.newInstance()
                                 .claim("foo", "bar")
                                 .id("test-subject-id")
@@ -303,7 +303,7 @@ void query_byJsonProperty_credentialSubjectComplex() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .credentialSubject(CredentialSubject.Builder.newInstance()
                                 .claim("complexSubject", Map.of(
                                         "sub-key1", "sub-value1",
@@ -331,7 +331,7 @@ void query_byJsonProperty_issuanceDate() {
 
         var issuanceDate = Instant.parse("2023-12-11T10:15:30.00Z");
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential()
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential()
                         .issuanceDate(issuanceDate)
                         .build()))
                 .build();
@@ -368,15 +368,15 @@ void query_byStatus() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential().build()))
                 .state(REVOKED)
                 .build();
         var secondCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JWT, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_JWT, createVerifiableCredential().build()))
                 .state(REQUESTING)
                 .build();
         var thirdCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JWT, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_JWT, createVerifiableCredential().build()))
                 .state(REVOKED)
                 .build();
         creds.add(expectedCred);
@@ -400,15 +400,15 @@ void query_byStatusMultiple() {
         var creds = createCredentials();
 
         var expectedCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential().build()))
                 .state(REVOKED)
                 .build();
         var secondCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JWT, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_JWT, createVerifiableCredential().build()))
                 .state(INITIAL)
                 .build();
         var thirdCred = createCredentialBuilder()
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JWT, createVerifiableCredential().build()))
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_JWT, createVerifiableCredential().build()))
                 .state(VcStatus.NOT_YET_VALID)
                 .build();
         creds.add(expectedCred);
@@ -516,8 +516,8 @@ protected VerifiableCredentialResource.Builder createCredentialBuilder() {
                 .issuerId("test-issuer")
                 .holderId("test-holder")
                 .state(VcStatus.ISSUED)
-                .participantId(TEST_PARTICIPANT_CONTEXT_ID)
-                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.JSON_LD, createVerifiableCredential().build()))
+                .participantContextId(TEST_PARTICIPANT_CONTEXT_ID)
+                .credential(new VerifiableCredentialContainer(EXAMPLE_VC, CredentialFormat.VC1_0_LD, createVerifiableCredential().build()))
                 .id(UUID.randomUUID().toString());
     }